Defense One - Threats

The war on Iran is stripping the western Pacific of US naval forces

Jennifer Hlad — Thu, 05 Nov 2026 16:45:20 -0500

Half of the U.S. Navy’s Japan-based destroyers are currently supporting the war on Iran, belying Trump-administration strategy documents that called the Pacific theater a top priority and undermining relations with Western Pacific allies.

Five of the 10 destroyers homeported in Yokosuka, along with the Yokosuka-based aircraft carrier George Washington, are deployed to U.S. Central Command’s area of responsibility to help fight a war of choice. Navy officials have told the crews of at least some of those destroyers they won’t return home until 2027.

“It’s really a big problem. It’s a problem for credibility. It’s a problem for our allies in the Far East…who, in a lot of cases, have been planning months in advance for carrier visits and for carrier battle group visits,” said Ralph Cossa, chairman and WSD-Handa chair in peace studies for the Honolulu-based Pacific Forum. And aircraft carriers deploy with several other types of ships, he pointed out.

“That’s all assets that normally would be in the Pacific, that normally would be showing the flag, that normally would be reminding our allies of our commitment. And they’re nowhere to be found.”

This is not what is prescribed by the National Security Strategy, which was released less than a year ago. “Preventing conflict requires a vigilant posture in the Indo-Pacific,” the NSS says. “The days in which the Middle East dominated American foreign policy in both long-term planning and day-to-day execution are thankfully over.” This was echoed in January by the National Defense Strategy, which declared that its top priorities were the U.S. homeland and deterring China.

But five weeks later, President Trump launched a war against Iran. And although Operation Epic Fury officially concluded in June, the Pentagon is keeping a large force in the region, making occasional attacks, and waiting to see whether Trump will order more.

U.S. Pacific Command officials pushed back on the suggestion that they are scaling back the China-deterrence mission.

“Our commitment to the security of the Indo-Pacific and to our allies and partners remains steadfast,” a PACOM spokesperson said, adding that the command “remains focused on deterring aggression and maintaining the readiness required to execute our assigned missions. We continually assess operational requirements and coordinate with the Department of War to ensure our forces have the capabilities and support necessary to meet them.”

Highlighting the recent Keen Sword military exercise, which included participation from the California-based Theodore Roosevelt carrier strike group, the spokesperson said “continuous training and exercises across the Indo-Pacific strengthen readiness and interoperability, while demonstrating our ability to respond to regional contingencies.”

Last week, at the TechNet Indo-Pacific conference in Honolulu, PACOM’s deputy commander, Lt. Gen. George Rowell, underscored that message in a keynote speech.

“Our mandate at U.S. Pacific Command is very clear: deterrence is our highest duty, and our guiding framework is to establish denial defense in the first island chain. We aim to prove that military aggressions will be infeasible, escalation will be catastrophic, and the costs of conflict far outweigh any gains.”

But, said Katherine Kuzminski, vice president of studies at the Center for a New American Security, sending so many of the U.S. Navy warships that are earmarked for patrolling the Pacific to the Middle East—and keeping them there for much longer than traditional Navy deployments—indicates “that our operations currently are not aligning with the administration’s stated national security strategy and national defense strategy, and that makes it really difficult at the service level or at the combatant command level to determine what the requirements are going to be.”

The military must be ready to respond, Kuzminski said, so “if there was some sort of incident that happens in the Indo-Pacific, we would want to be able to shift all of our resources there. But right now we’re kind of treating the [U.S. Central Command area of responsibility] in that way when we’ve committed to not be bogged down in the CENTCOM AOR.”

It’s not the first time the U.S. pivoted on the Pacific.

In 2012, under President Barack Obama, the Pentagon called for a “rebalance to the Indo-Pacific region,” including moving more troops and ships to the area. In 2016, then-Defense Secretary Ash Carter said the rebalance was not transient, but “enduring.” One year later, during the first Trump administration, a State Department official declared the rebalance officially dead.

Chinese president Xi Jinping has reportedly told his military to be prepared to take Taiwan by 2027. Cossa, like other experts, said he doesn’t believe “for a minute” that the Chinese will actually attack Taiwan next year, “but certainly, part of deterrence is convincing Xi that the U.S. has a commitment in this area and that we are going to respond. And when we have a third of our operational fleet out in the Middle East, that just sends the wrong signal.”

Keeping 7th Fleet sailors in the U.S. Navy Central region “for a year is going to be really poor for morale aboard ship and at home,” a Navy officer and expert on Pacific security told Defense One. “Trying to hide the cost by pulling [7th Fleet] away from home is just accounting fraud, and is hurting the fleet’s ability to show up for exercises in the Pacific, which will create its own hangover of damaged credibility, and contributes to the perception that the U.S. isn’t living up to its commitments on security in the region. I’ve heard that the fleet has been told to expect a 17 DDG requirement [in the Middle East] until 2029, which is insane. In terms of deterrent capability, most people I know think this is China’s clearest operational window for action against Taiwan, if the military balance were its only consideration.”

The good news from a Chinese standpoint, Cossa said, “is it continues to show how unpredictable our president is.”

“At this point, no Chinese planner in their right mind is going to factor the U.S. out. If you’re doing war gaming and practicing for an invasion, you have to factor the U.S. in.”

The question is, he said, “what do they think we can do if we’re there?”

]]>

Hackers are targeting refrigerators worldwide, US agencies warn

David DiMolfetta — Thu, 05 Nov 2026 14:00:00 -0500

Federal agencies warned Thursday that hackers are targeting refrigeration systems worldwide, urging operators to secure equipment whose recent failures have spoiled food and created fire hazards.

CISA, the FBI, and the departments of Health and Human Services, Agriculture, and Transportation issued joint warnings that attackers are targeting electronic temperature controls at grocery stores and cold storage facilities.

The warning follows Nextgov/FCW’s report last week that U.S. officials suspect Iran-linked hackers were behind freezer malfunctions at military bases across the country. Those incidents began around late August and have affected roughly six commissaries, the on-base grocery stores that serve military personnel. Reuters initially reported that the Pentagon was treating the freezer incidents as possible cyberattacks.

In France, hackers targeted refrigeration systems at three regional blood banks overnight Sunday into Monday. And this week, a new wave of supermarket attacks raised fridge temperatures at stores in Sweden, Belgium, Luxembourg and elsewhere, forcing retailers to discard food. The incidents followed attacks at hundreds of French establishments in October.

The U.S. notice does not name who is responsible for the cyber sabotage.

Hackers could force refrigerators and freezers into continuous heating or defrost cycles, the agencies said. They could also prevent operators from seeing current temperatures, making it harder to monitor conditions inside the units. Beyond spoiled inventory and damaged equipment, the agencies warned of fire hazards and potential harm to consumers who use products kept at unsafe temperatures.

Such hacks are possible because various digital vulnerabilities tied to refrigeration controls can expose their underlying equipment to hacking and sabotage, including devices connected to the internet that are used to remotely monitor or control temperatures.

“Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

Hospitals, pharmaceutical suppliers, chemical companies and transportation providers also depend on these systems.

“We are seeing these systems targeted across critical infrastructure sectors globally, putting inventory and equipment at risk,” said Brett Leatherman, the FBI’s cyber branch operations director.

The agencies urged operators to remove control systems from the public internet and secure any remote access they still need. They also recommended separating refrigeration controls from business networks, replacing default passwords, installing security updates and retiring equipment that manufacturers no longer support.

The hacks follow a pattern closely aligned with Iranian hackers, said Nahman Khayet‏, the co-founder and CEO at Alt Security.

“They’ve been playing this game for many years,” he said in an interview. “Think about how hard it is to replace those refrigerators, right? They’re huge things. It’s very costly. And also you don’t want to do any disruption to those because they probably hold a lot of items which are important, like food.”

That dynamic means that it’s unlikely the devices are getting the latest security updates, which Iranian cyber operators have often leveraged to get inside systems, including various types of critical infrastructure, he added.

European authorities issued their own joint warning Wednesday, calling for immediate action to secure exposed equipment. The European Commission, cybersecurity agency ENISA, Europol and national authorities are coordinating their response and sharing information about the incidents.

]]>

Officials suspect Iran of cyberattacks on military base freezers

David DiMolfetta — Mon, 02 Nov 2026 09:00:00 -0500

U.S. officials suspect Iran-linked hackers are behind a series of cyberattacks that have targeted freezers at military bases around the country and caused them to malfunction, according to two people familiar with the matter.

The outages have affected around six commissaries, the on-base grocery stores serving military personnel. The people spoke on the condition of anonymity to communicate sensitive knowledge about the intrusions, which began around late August.

It’s not clear how exactly the cyberintruders may have accessed the freezer systems, though various digital vulnerabilities tied to freezer controls can expose the equipment to hacking and sabotage. It’s possible the assessments may change as investigators learn more about the hacks.

The attacks, if fully confirmed to be tied to Iran, would demonstrate the nation’s ability to disrupt certain military-related equipment inside the United States through cyber means, and comes as the Trump administration is reportedly planning follow-up strikes on Iran after the U.S. midterm elections next week.

The attribution would also fit a broader pattern of suspected Iranian activity against equipment controlling water treatment processes in recent months.

Iran has previously combined hacking in lead-ups to elections. During the 2024 presidential campaign, U.S. officials attributed the theft of Trump campaign material to Tehran⁠.

Cyber Command and various Defense Department law enforcement units are probing the freezer incidents. French authorities are also working with officials examining the matter. Earlier this month, hackers overrode temperature controls on commercial refrigeration equipment at some 350 French establishments, which forced supermarkets to discard spoiled food.

The investigation draws attention to the computers that control everyday equipment used to store and handle food, an often overlooked area of cybersecurity where a hack can spoil supplies or interrupt distribution of goods.

The Food and Agriculture Information Sharing and Analysis Center, an industry group that shares cyber threat intelligence on the nation's food supply, has warned that attackers can target internet-accessible industrial controls that may not have optimal cyberdefenses in place.

]]>

Six military freezers went bad in August. Was it a cyber attack?

David DiMolfetta — Thu, 29 Oct 2026 17:00:00 -0400

The Pentagon is investigating a suspected cyberattack behind freezer malfunctions that spoiled food at military bases across the United States in August, according to a U.S. official familiar with the matter.

The outages affected some six commissaries — the on-base grocery stores serving military personnel — per the official, who spoke on the condition of anonymity to discuss the situation. At Fort Huachuca in Arizona, officials reported that a freezer had entered defrost mode and heated its contents, leaving food spoiled.

Reuters first reported Thursday that investigators were treating the incidents as a possible hack. It’s unclear who might be responsible or whether investigators have conclusively determined what caused the failures.

Cyber Command and various Defense Department law-enforcement units are probing the incident. French authorities are also working with officials examining the matter. Earlier this month, hackers overrode temperature controls on commercial refrigeration equipment at more than 350 French establishments, forcing supermarkets to discard spoiled food.

The unusual U.S. outages and the possibility of hacking were initially flagged in August by the Signal and Silence blog. Stars and Stripes subsequently reported the involvement of military investigators, and The Telegraph also reported officials’ contact with French authorities.

A 2021 DHS assessment of threats to food and agriculture specifically identified refrigeration failures and shipping delays as cybersecurity risks that could cause spoilage and shortages.

The Food and Agriculture Information Sharing and Analysis Center, an industry group that shares cyber threat intelligence on the nation's food supply, has warned that attackers are targeting internet-accessible industrial controls that may not have optimal cyberdefenses in place.

The agri-food sector’s sensitivity to downtime often gives ransomware groups leverage to demand payment, the organization said in a separate report.

Lawmakers have sought to improve federal protections. A bipartisan group reintroduced the Farm and Food Cybersecurity Act in 2025, following an earlier proposal introduced in 2024.

]]>

The port-call situation is wearing out Navy warships

Jennifer Hlad — Tue, 27 Oct 2026 23:19:32 -0400

A few years ago, a port call in the Middle East might mean bottomless-mojito brunches in Bahrain, hitting the indoor ski slopes in a Dubai megamall, or a desert safari in Qatar. But since Operation Epic Fury began eight months ago, U.S. warships in the theater have basically had just one option: Diego Garcia, some 2,500 miles away.

It’s not great for morale, but the consequences go beyond disgruntled sailors who tire of fishing off the British island in the Indian Ocean. The remote coral atoll lacks the pierside infrastructure that many Gulf, Mediterranean, and Pacific ports can offer. As the Navy stretches its fleet with longer deployments and fewer port calls, warships are losing the ability to do crucial mid-cruise maintenance.

“When a ship is deployed overseas for longer than the nominal seven-month deployment period, that increases the amount of time for equipment on the ship to break, get worn down, or worn out. As a result, when the ship finally does make it back to the United States, it might need more maintenance and repair work than it would have needed if the deployment had not exceeded seven months,” said Ron O’Rourke, who retired this year after more than 40 years as a naval analyst for the Congressional Research Service.

“That can increase the time and cost to do the maintenance and repair work, and an increased time needed to do the work could prevent other ships from entering maintenance and overhaul as scheduled. This can lead to a cascading effect in delaying maintenance on other ships.”

A Navy officer with expertise in maritime security agreed, noting that “even deployed ships need time alongside”—that is, moored directly to a pier or tender vessel for what’s called voyage repair availability—“to fix broken things, remediate rust, paint, etc. If these ships are kept out for 10 to 12 months, they’ll be missing other scheduled maintenance events and be much more broken than they should be when they get home.”

The Navy itself nodded to the problem in a recent press release about the aircraft carrier Abraham Lincoln, which is changing homeports to receive overdue depot-level maintenance after a nearly 11-month deployment.

“Regularly scheduled depot-level maintenance maximizes the lifespan of our Navy vessels and keeps our fleets lethal, modern, and ready to defend the nation.”

The Lincoln’s 321-day deployment—and the carrier Gerald R. Ford’s 326-day deployment before it—set records for consecutive days at sea and length of deployment, respectively. But a few Arleigh Burke-class guided missile destroyers are on track to far surpass those numbers. And Navy officials recently told families in Yokosuka, Japan, that for the foreseeable future they should expect all ships to deploy for 10 to 12 months.

A Navy spokesperson said they would “not discuss specific readiness rates, operational requirements, force-allocation deliberations, or future force movements. However, we remain committed to regular maintenance to maximize the lifespan of our Navy vessels and keep our fleets lethal and ready to defend our nation.”

‘It’s empty’

Instead of the luxury hotels and hundreds of restaurants sailors can visit in ports like Dubai and Bahrain, Diego Garcia has a military supply base and a small town with a handful of restaurants. And since virtually every ship deployed in the region is using the island for port calls and resupply, store shelves don’t always stay stocked.

The guided-missile destroyer John Finn, which left Japan in January, pulled into Diego Garcia after months at sea.

“Everybody’s going to the ship store and it’s empty,” a sailor’s spouse told Defense One. “You can find ice cream, but you’re not going to find your necessities that you need to function.”

The ship had pulled in because it was “empty,” the spouse said, after having spent all of its weapons in the campaign against Iran. “So they had to spend that week resupplying.”

The spouse of a sailor on the Mustin, another guided-missile destroyer, said her husband was able to get socks but not shoe polish at the exchange on base during the only port call the ship has made since leaving Japan in April.

“He got off like, preparing to be able to get the stuff that he needed right now, and he goes, ‘They don’t have shit,’” she said. “They didn’t have anything.”

For the Mustin crew, the port call seemed like a welcome respite from their months at sea, until they were told just before getting off the ship that they would not return in August as originally planned, but stay deployed until April 2027, the spouse told Defense One.

“The sad part is, they were actually in good spirits,” she said. “And then I know things went really rowdy in Diego Garcia because they were given the bad news literally the day before they pulled in. … There was one of the nights in Diego Garcia that two sailors ended up in the ER with alcohol poisoning. And so then they lost their last night of liberty because of it.”

O’Rourke said the British island “can provide an opportunity to be on land for a while, and to engage in certain R&R activities. But the options for doing R&R things at Diego Garcia are a lot more limited than they are at other ports, such as Singapore or somewhere in the Mediterranean.”

Ralph Cossa, chairman of the Pacific Forum, was less diplomatic.

“Please shoot me if that’s the only R&R I’m going to get in 10 months,” he said.

Mail delays

Sailors have asked their families and friends to send them supplies, but mail is taking three to six months to reach the destroyers, the spouses said.

The Mustin spouse sent her husband several boxes at the start of the summer; all but one took four months to arrive. The John Finn spouse said it also took four months for a few packages to reach her sailor, and some that “took even longer than six months to get out there.”

“I think I’ve sent my husband the same thing three different times now, and I’m like, well, hopefully one of these gets to you in the next two or three months, and whenever the other ones show up, you’re just gonna have an abundance. Share it with somebody else.”

Both spouses expressed concern about the sailors’ ability to vote in the upcoming elections, given the mail delays. The John Finn spouse said her husband, who has done multiple deployments in the past, said, “There has been no conversation about voting because we don’t have time for it. We don’t have time to even have conversations because we are busy doing all of this other crap that nobody wants to be doing to begin with.”

By contrast, sailors aboard the George Washington aircraft carrier generally “can expect to receive mail shipped from the states within weeks,” Lt. Cmdr. Bobby Dixon, a ship spokesperson, told Defense One. “However, this can take longer when deployed overseas. We work with our U.S. military logistics teammates to minimize mail delays and we are committed to ensuring all service members can exercise their right to vote.”

Maintenance

Navy ships, like any other vehicles, require a certain amount of maintenance to continue working. There are three levels of repairs: basic, intermediate, and depot-level maintenance.

Deployed ships are under stress from the salt water and sea air, and more things are likely to wear down or break when they’re being used frequently for long periods of time. And the forward-deployed destroyers based in Yokosuka—including the John Finn and the Mustin—are usually in a cycle in which they spend just a few months at sea before heading back home for a few months of maintenance.

Now those two destroyers are slated to be at sea for a year or more, which will mean they will miss the beginning of their planned five-month shipyard maintenance periods. And the Mustin spouse said there were already some maintenance problems on that ship when it shifted homeports from San Diego, Calif., to Yokosuka, just before it left for deployment.

“Their maintenance log was 100 percent not empty,” and there were a lot of things “that they should have been turned around for,” she said. The ship was told to head to Japan anyway.

And though the sailors were told their lone port call was planned so they could perform maintenance, “they never got anything fixed when they went to Diego Garcia. … They didn’t actually go up pierside.”

O’Rourke said there are consequences for delays to the intermediate and depot levels of maintenance.

“If you have a period where the total fraction of the Navy being on deployment overseas is elevated above what the notional model calls for, there will be a period downstream where you have to pay the piper, where the fraction of the Navy that will be available for deployment will be less than what the notional model called for because you're making up for that earlier period,” he said.

It’s not a new problem.

“Years ago, the Navy got itself into a hole on conventional surface ship maintenance due in part to what turned out to be underestimates in planning, scheduling, and funding that work. Since then, the Navy has been working for years to dig itself out of that conventional surface ship maintenance hole. Perturbations in ship maintenance and repair schedules caused by ships being used for extended deployments can add to the Navy’s challenge of digging itself out of that hole,” O’Rourke said.

So the service needs to give its ships the maintenance they need. But that’s unlikely to happen while the Navy is keeping so many ships in theater, a second Navy expert said.

“The end result is that deferred maintenance becomes more and more problematic, causing knock-on effects like parts and equipment wearing out or breaking before they should. In the end, these ships will reach their end of service life well before their scheduled date.”

]]>

Funding, force-structure issues could hinder Hegseth’s new autonomous command

Meghann Myers — Sun, 25 Oct 2026 06:00:00 -0400

The Pentagon’s effort to launch a new combatant command for autonomous warfare depends on an unusual funding bill whose passage is far from assured. And while Defense Secretary Pete Hegseth has given his department a full year to start up U.S. Autonomous Warfare Command, the Pentagon has little of the relevant force structure that earlier functional COCOMs could draw on.

“They have no idea. They don't know, nor should they. There's nobody on that stage that actually knows how to build anything like this,” John G. Ferrari, a nonresident senior fellow at the American Enterprise Institute and retired two-star general, told Defense One.

Ferrari was referring to an Oct. 14 panel featuring Hegseth, the service secretaries, and the Pentagon’s top special operations civilian.

“But they've now set the direction and the intent,” he said. “And they're going to give it to a commander and say, ‘Now go build it.’ ”

Hegseth sat down to discuss the new command on the final day of the AUSA annual meeting in Washington, D.C., moderated by Owen West, the first CEO of the new Direct Reporting Portfolio Manager for Unmanned Systems. The secretary said AUTOWARCOM would become the Pentagon’s official purchaser of autonomous technology, but offered few other details.

“My vision for AUTOWARCOM, in two years, is that we're still iterating, we're still adapting, we're still learning, and we're moving faster and faster because we're doing it,” he said. “We understand how to do it better with each iteration.”

West later ribbed Hegseth, saying that he counted the secretary saying “iteration” and “adaptation” seven times during an answer to one question. Indeed, most of the Pentagon’s messaging about AUTOWARCOM has included what they want to do, and less how they are going to do it.

Needed: force structure

Though U.S. Autonomous Warfare Command would be a functional combatant command like Cyber Command and Special Operations Command before it, in many ways it will be working backwards rather than building upon existing force structure. The plan calls for creating service component commands where there were none; and creating a new autonomous-warfare corps of officers and enlisted service members. Neither Hegseth’s memo directing the creation of the command nor the more recently released “operational roadmap" describe how these specialties will integrate with existing units.

A four-star combatant command whose primary mission is acquisitions doesn’t make a whole lot of sense, according to Mark Cancian, a senior adviser at the Center for Security and International Studies.

“Typically, [COCOMs] operate forces. So having one that just does acquisition requires a wide variety of new authorities on acquisition, which they might be able to get,” Cancian said. “It's not that it can't be done, but you know, I think there are structures that would be better for accomplishing what it is they want, which is the more rapid development of drone capabilities.”

Cancian has argued that a model more like the Missile Defense Agency, a three-star command with its own significant budget, is probably better suited to what Hegseth would like to accomplish with AUTOWARCOM.

“The model of, ‘they develop a technology, develop a system, and then hand it off to the services’—that makes a lot of sense,” he said. “It would be a very bad idea to have this command take over drone operations for all the services, because those operations need to be very tightly coordinated, very tightly integrated with the operating forces, and having them work for someone far away, and someone separate and centralized, I think, would be a very bad idea.”

Ferrari said it’s more likely that AUTOWARCOM will have responsibility for some training and doctrine associated with the new systems, rather than the actual use of them.

“The responsibility is going to be to pull all of this stuff together, and take all these disparate organizations that are working on this stuff, focus them with money, and then get the stuff in the hands of warfighters, right?” he said. “Because buying it is the easy part. Using it is the hard part.”

Then there is the matter of what the command’s force structure will look like. The day after Hegseth announced AUTOWARCOM, the Army announced it would bring online its own autonomy command promptly. Days later, the service rebranded its Futures and Concepts Command as Futures and Autonomy Command, creating a fully staffed and funded AUTOWARCOM component command with minimal friction.

The Navy and Air Force, when asked about their plans to set up component commands, referred Defense One to the Office of the Secretary of Defense.

“I think, you know, if they actually did this, they'd create some sort of component command,” Cancian said. “Probably dual-task some existing organization, the way the Army has done.”

The Pentagon is working with the services to “ensure autonomous capabilities are integrated,” a Pentagon official, who was not authorized to speak on the record, told Defense One.

“The Services support AUTOWARCOM and are taking complementary actions to organize and integrate autonomous capabilities within their respective forces, based on their unique operational requirements, force-development responsibilities, and domain expertise,” the official said.

They pointed to the Navy’s new Direct Reporting Portfolio Manager for Robotic and Autonomous Systems and said the Air Force is “actively exploring organizational structure elements to enable rapid implementation and training of unmanned systems.”

The official did not directly answer a question about whether Hegseth was inspired to create AUTOWARCOM by pre-existing Army plans, instead reiterating that the service’s announcement followed the secretary’s.

Who will lead it?

Who will lead the new command? The military already has enlisted drone operators, some junior officers with experience integrating unmanned and autonomous systems into their units, and a handful of senior officers who have been leading larger formations as they have integrated more unmanned capabilities.

“There are a lot of warfighters out there who know what they're doing,” Ferrari said. ”And it's unfortunate, because you’ve got a [Chris] Donahue, or Erik Kurilla, or Randy George, right? So there are three people who could have led that thing. Warfighters.”

Those former Army four-stars—the former head of U.S. European and Africa Command, head of U.S. Central Command, and Army chief of staff, respectively—were forced into retirement over the past year or so.

Kurilla and Donahue weren’t selected for follow-on jobs, despite expectations. George was flat-out asked to leave early, opening an opportunity for Hegseth’s senior military aide, Gen. Chris LaNeve, to take over as Army chief.

The department will announce leaders when appropriate, the Pentagon official said. A plan of action and milestones is due at the end of this month.

The funding elephant in the room

Earlier this year, the Defense Department asked for $54 billion to fund the Defense Autonomous Warfare Group, which Hegseth has since said would be used to get the new command off the ground.

But the Trump administration elected to request that sum, along with several other top military priorities, not in the $1 trillion defense budget but in a separate bill to be passed under a process rarely used for Pentagon spending before last year.

“We’re running fast immediately with the committees to ensure that that reconciliation bill, at a minimum of $350 billion, potentially more, ultimately fills up what this department needs,” the Pentagon official said.

But reconciliation bills are a hard sell, even for Republican members of Congress allied with the Trump administration. As the midterm election threatens to shift the balance of power back to Democrats, extra funding on top of the budget request is not even remotely a done deal.

“Either the money shows up by Christmas or it ain't coming, because when the new Congress gets seated in January, there is no reconciliation anymore,” Ferrari said. “It's over.”

He said the Pentagon could still stand up the organization, but it won’t have the buying power necessary to meet its mission.

Or, Cancian suggested, they can try to squeeze some acquisition money out of the services.

“And the services are not going to be happy about that,” he said. “You're already going to have to give a whole bunch of people to this new command. They'll be levied for joint billets. To say, ‘All right, we want you to give up a thousand people and X billion dollars for this new thing’—it’ll be very difficult to do.”

Asked whether the Pentagon has a back-up plan to fund AUTOWARCOM, the official reiterated that the department is asking for the $54 billion through reconciliation.

Said Ferrari: “If there's no money, it's an interesting concept, and we can ponder on this thing over the next two or three years, because it's not going to go anywhere fast.”

]]>

Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI

David DiMolfetta — Wed, 21 Oct 2026 12:30:00 -0400

Two critical flaws in software widely used in websites have the NSA, FBI, and Cybersecurity and Infrastructure Security Agency urging organizations to update their systems or take them offline immediately.

The vulnerabilities affect PHP, a programming language that works behind the scenes to run websites, process forms, and retrieve information. Hackers could exploit the flaws to run commands on an affected server without logging in, potentially allowing them to steal data, change a website’s contents, or take control of it, the agencies said Wednesday.

PHP powers run roughly 70% of websites whose underlying server-side programming language can be identified, according to web technology tracker W3Techs. It is a key part of popular website-building platforms, including WordPress, Drupal, and Joomla.

Palo Alto Networks’ Unit 42 said it identified more than 22.6 million internet-exposed instances that might be vulnerable.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the cyberdefense agency said in a blog post.

A Nextgov/FCW analysis using Shodan, a search engine that catalogs internet-connected systems, identified roughly 900 results associated with U.S. federal, state and local government websites that showed signs of PHP use. Many listed older versions of the software, though it’s unclear if the records reflect the versions currently running on those systems, as Shodan may not yet have captured recent updates.

Governments in Europe have already been taking some websites offline to implement fixes.

“I’d expect a great deal of opportunistic exploitation: attackers don’t need to know what’s vulnerable before they start knocking on doors,” said Trey Darley, the founder of Proper Tools, a cybersecurity standards consultancy. “Meanwhile, defenders can’t reliably count what they need to patch and protect.”

“Right now, the priority is protecting the systems people actually have,” he added.

The U.S. government was involved in coordinating the response ahead of disclosure. OpenAI said it and its partners engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director and Cybersecurity and Infrastructure Security Agency to help security guidance reach organizations responsible for critical infrastructure and other essential services.

The flaws, collectively known as “php2shell,” affect the software beneath websites rather than a single website or application. That means an organization could have carefully secured its own code and still be exposed through the PHP software running it.

Cybersecurity company Wiz said it demonstrated successful attacks against WordPress, Drupal and Joomla installations. Researchers also showed they could read sensitive information from a server’s working memory, including passwords and access credentials.

PHP’s developers also said all installations handling web requests are at risk. Under certain setups, an attack can take place before the website’s own code even executes.

The discovery adds to evidence that AI is helping researchers find and exploit flaws in widely used software. OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the development and release of fixes.

PHP’s developers released updates Wednesday for supported versions of the software. They said organizations using Linux distributions or long-term support services should check their vendors for updated packages, including fixes adapted for older versions.

The warnings followed an early leak that accelerated plans to disclose and fix the vulnerabilities. A post on the technology forum Hacker News surfaced Tuesday morning and was subsequently removed, but screenshots spread across social media, according to cybersecurity firm Huntress. PHP’s developers then announced that fixes would arrive a day ahead of the planned disclosure, leaving website operators little time to prepare for updates.

Editor’s note: This story is breaking and may be updated.

]]>

Military power rising as power of diplomacy falling, diplomats, crisis monitors, allies say

Patrick Tucker — Tue, 20 Oct 2026 19:53:00 -0400

DOHA, Qatar–International norms and humanitarian law are losing influence just as new military capabilities are becoming easier to access—a central theme of two days of talks among diplomats, government officials and humanitarian workers here.

“Conflicts are now a first resort in many cases. Diplomacy and dialog are being delegitimized,” said Pierre Krähenbühl, director-general of the International Committee of the Red Cross.

Krähenbühl was far from alone in his assessment at the Global Security Forum, hosted in this Gulf capital by the Soufan Center and the Qatar International Academy for Security Studies. Officials from Europe and the Middle East, as well as former senior intelligence officials from Australia and Britain, questioned the durability of the alliance structure that the United States and its Western allies put in place after World War II.

"The war in Lebanon today and on Lebanon shows that there are countries, Israel is a case in point, that do not need alliances, for they are engaged in an offensive war, and alliances in today's world are largely defensive,” said Deputy Prime Minister Tarek Mitri of Lebanon, which remains partly occupied by Israeli forces.

But that breakdown isn't happening on its own. Sir John Sawers, former chief of Britain's MI6 intelligence agency, pointed to the United States' declining commitment to its traditional security guarantees, even as the 8-month-old U.S.-Israeli war against Iran has exposed American partners in the Gulf to new threats.

Saudi Arabia, Qatar, and the United Arab Emirates are reconsidering their security relationships with Washington, Sawers said.

“The United States was the guarantor of their security. And what of course these countries have experienced in the last six months is the attacks on them have been provoked by a U.S-instituted war of choice against Iran."

Europe is confronting similar questions as the Russian campaign against NATO grows more brazen and sophisticated. Sawers said America is eroding the international system it helped establish: one of the challenges to the rules-based order is “the United States losing confidence in the system which they designed and which has benefited America enormously.”

Sawers disputed the idea that Europe is rearming simply because of pressure by Donald Trump.

"The reason we're increasing money on defense now isn't because President Trump is telling us to do so. It's because the threat from Russia is much greater than it was before. And the reliability of the United States is less than it was before,” he said.The conference’s host country, Qatar, has found that its longtime efforts to play international mediator no longer keep it safe. The capital came under attack by Israel in 2025, and six months later by Iran.

“It was a surprise because it's the first time that a mediator has been attacked. This never happened,” said Sheikh Saoud bin Abdulrahman Al Thani, Qatar's deputy prime minister and minister of state for defense affairs..

Al Thani identified three threats to Qatar: attacks on its sovereignty, disruptions to energy flows from Gulf Cooperation Council countries, and the spillover of regional conflicts.

Tom Barrack, U.S. special envoy for Syria and Iraq, said the United States remained committed to diplomacy and proposed a path out of the regional violence beginning with a ceasefire, reopening the Strait of Hormuz, and easing economic pressure on the Iranian people. But he cautioned against expecting any agreement to resolve the underlying conflict quickly.

"What we know in the Middle East is there's no such thing as a deal. There's no event. This process is going to continue,” said Barrack, a billionaire financier who served as a go-between from candidate Trump to Gulf princes during the 2016 campaign.Nick Warner, former director-general of Australia's Office of National Intelligence and former ambassador to Iran, put the issue more bluntly: "And the answer to how does the war with Iran end is: it doesn't."

]]>

Trump appointees asked a federal cybersecurity agency to secretly hack a voting machine

Doug Bock Clark and Andy Mannix, ProPublica — Mon, 19 Oct 2026 20:23:36 -0400

A few months into President Donald Trump’s second term, political appointees at the Department of Homeland Security made an unusual request of its agency focused on cybersecurity: Secretly acquire a voting machine and hack it.

The appointees wanted the Cybersecurity and Infrastructure Security Agency to procure the machine, examine it and report back the findings so they could be given to the White House, according to two former administration officials with knowledge of the request.

The proposition was shocking to CISA’s career staffers, according to one of the former officials. CISA typically worked to thwart hackers. Moreover, the agency had been directed not to alert the voting machine company if it uncovered flaws, contrary to its standard practices. The request made the CISA employees fear they were being asked to take part in political interference.

“My thought was they could keep it in their back pocket to invalidate any [election] results they don’t like,” one of the former officials said. “This goes against everything CISA represents.”

The CISA employees repeatedly told the political appointees that their request was impossible, in part because the agents capable of pulling off such an operation had just been laid off by Elon Musk’s Department of Government Efficiency initiative. The appointees eventually stopped pressing CISA.

Though not acted on, the request shows how the Trump administration has tried to use the agency for its own ends while draining it of resources for one of its critical missions: protecting the nation’s voting systems.

In Trump’s second term, his administration has laid off or pushed out more than 1,000 CISA employees, shrinking the agency by about one-third. The president’s 2027 budget proposal would reduce funding for the agency by another $700 million, which could necessitate 900 additional layoffs.

In response, Democratic lawmakers have called for an investigation into CISA’s ability to do its job and demanded answers as to why federal funds are not being used to support election security as directed by Congress.

Since Trump signed the CISA Act in 2018, the agency has worked with state authorities and voting machine vendors to help protect election infrastructure from cyberattacks. During Trump’s second term, though, CISA has abandoned much of this work. Several state election authorities said the agency provided them no assistance — and no explanation for its absence — during the most critical planning stages for the upcoming midterms.

“There is a difference between deprioritizing and being nonexistent,” said Ryan Macias, an election technology and cybersecurity expert who has worked as a consultant for CISA. In 2025 and through mid-September 2026 — when the bulk of preparations for the election typically would have been completed — “they were nonexistent. Literally nonexistent.”

While Trump has repeatedly warned that America’s elections are vulnerable to hacking, in some cases repeating disproven claims, experts said his administration is undermining the federal government’s role in helping secure them.

Though CISA re-emerged in September with a last-minute security plan for the election, some state officials told ProPublica they fear that what is left of the agency has been compromised by a conspiracy-obsessed presidential administration. In recent months, in reviving debunked theories about the 2020 election, the Trump administration has declassified troves of records, including sensitive material that state officials provided to CISA. Some state authorities said they no longer trusted the administration enough to share information with CISA, a key to the agency’s success in past elections.

“They’ve violated the entire premise of that information-sharing relationship,” said one former high-ranking federal cybersecurity official who now advises state governments on national security. “There’s no fucking way they’re ever going to give any information to CISA. And it’s unclear if they ever will in the future.”

A spokesperson for the White House declined an interview request but defended Trump’s handling of election security in an emailed statement. “President Trump has done more than any other President to ensure we have free and fair elections,” said Lauren Bis.

Bis referred specific questions about CISA’s handling of elections to DHS. DHS and CISA did not respond to interview requests or to a detailed list of questions.

Current and former CISA employees and state election officials describe an agency that has become significantly less equipped to help states fight legitimate cyber threats. State leaders say they have used their own resources to shore up gaps left by CISA, such as paying for sensor technology that can detect unusual activity in election networks. But some services, like intel on foreign actors, can’t be replicated. Some people interviewed said they were worried that Trump and his allies continue to ratchet up rhetoric about voting security, particularly about threats to voting machines. Officials in one large voting jurisdiction said they have met privately with machine vendors to come up with a contingency plan if the federal government seizes their machines or declares them unusable.

“I don’t pay attention to what the president says. I pay attention to what his administration does,” Arizona Secretary of State Adrian Fontes said. “And what they’ve done is basically cut us off and left us on our own.”

Defending elections from hackers wasn’t always part of DHS’s remit.

Throughout the mid-1990s and 2000s, a series of cyberattacks rocked the federal government, demonstrating the emerging threat. In 2007, hackers broke into the Pentagon and stole terabytes of sensitive data. The digital heist, by an unknown foreign adversary, was so damaging that one intelligence leader later described it as an “espionage Pearl Harbor.”

Under George W. Bush, DHS underwent a reorganization to more effectively combat terrorism and respond to disasters like Hurricane Katrina. The department dedicated resources under an office called the National Protection and Programs Directorate to help fortify advanced cyber defense systems and important infrastructure. The office’s work ranged from helping secure events like the Super Bowl to protecting chemical plants to issuing cybersecurity warnings to the private sector and the public. In 2018, Trump signed a bill making the office a stand-alone agency, allowing for more federal funding and transforming it into, essentially, the ultimate tech support desk for anything DHS designated “critical infrastructure.” The bill renamed the agency CISA.

Though Trump helped create CISA, he didn’t much appreciate the work the agency did under its old name to expose the extent of Russia’s meddling in the 2016 presidential election. Russian agents had unleashed a massive disinformation campaign, with a Kremlin-backed troll farm creating thousands of social media accounts posing as Americans and promoting Trump, according to bipartisan reports from the U.S. Senate Select Committee on Intelligence released before the 2020 election. A dozen Russian military agents were indicted for what the Justice Department described as “a sustained effort to hack into the computer networks of the Democratic Congressional Campaign Committee, the Democratic National Committee, and the presidential campaign of Hillary Clinton.”

Trump publicly downplayed this interference, but DHS leadership saw the Russia attack as an escalation. In January 2017, before Trump took office, DHS upgraded America’s elections to the status of critical infrastructure. This placed the polls and all voting technology used in federal elections under the watch of what would soon become CISA.

To carry out this function, CISA needed help. But states and voting machine vendors were wary about sharing data on weaknesses in voting systems, fearing it could be exploited if certain details were to become public. State officials were also reluctant to cede any role in election preparation to the federal government.

Gradually, though, CISA and state election officials negotiated a fragile trust. At its center was a commitment: The sensitive information states and vendors shared with CISA would be kept confidential.

“It took years and years of building trust, of talking to election officials, of hiring people with elections experience who could be validators for the work that CISA wanted to do, before they finally built strong working relationships,” said Derek Tisler, who specializes in election security as counsel for the nonprofit Brennan Center for Justice, a nonpartisan institute based out of New York University School of Law.

Under Director Chris Krebs, CISA hosted penetration testing in which its agents would try to hack into a state’s system to locate weaknesses that could then be patched, along with tabletop exercises simulating a series of potential catastrophes around elections. CISA also offered regular secret-level briefings to secretaries of state to share federal intelligence. And CISA paid for sensor technology that looked for potential malicious online activity on election networks, notifying officials about emerging threats.

“The staffing was there, the expertise was there, the visibility was there, the funding was there,” Macias said.

The consortium shared data as run of the mill as spambots as well as more serious threats. If Virginia caught unusual activity in its system, it could let other states know to be vigilant.

While CISA had prepared for attacks from the Chinese and Russian governments, or lone wolf hackers, few there had expected the threat to elections would come from inside the White House. But when Trump refused to concede to Joe Biden in 2020, claiming the vote had been rigged, CISA became a key component of the guardrails that ultimately led to the election results being certified.

The agency, in a statement co-signed by secretaries of state and voting machine vendors, vouched for the election’s integrity, calling it “the most secure in American history.” When Krebs publicly rebutted claims amplified by the White House as “unsubstantiated” or “technically incoherent,” Trump fired him over Twitter.

As Congress prepared to vote on certifying the election results, it was members of CISA, along with the FBI, who convinced then-Attorney General Bill Barr that the conspiracy theories embraced by the president could be explained by human error, not systemic fraud or hacking.

When Trump returned to the White House in January 2025, his administration immediately started to dismantle CISA. The administrative notices were sent out just a couple of weeks after the inauguration and included the team in charge of dispelling disinformation.

For the employees under the DOGE microscope, work became impossible, said one former senior CISA employee. “Those groups couldn’t even order a pizza.”

DOGE laid off people critical to the agency’s election work, including those who’d worked closely with states. The Trump administration cut funding for the technology that monitored web and election servers, blinding the federal government to breaches it had detected.

When it came time for states to prepare for the 2026 midterms, CISA had disappeared.

On the evening of July 16, in the Black Hills of South Dakota, dozens of election officials and their staffs gathered for a reception near Mount Rushmore. It was the third night of an annual conference for secretaries of state, drawing participants from red and blue states. They’d spent the week discussing state voter roll maintenance and voter ID — issues that at times made for disagreements.

At about 8 p.m., a wave of discomfort swept through the crowd, visible on attendees’ faces as they glanced frequently at their phones, according to people at the event. Any minute now, Trump was going to address the nation on election security. Some at the reception worried he would declare a national emergency, as his allies had urged him to do months earlier, and use it as a pretext to direct the government to seize voting machines.

Then reports on the speech began rolling in, and the mood shifted. The claims Trump was making were unsubstantiated and outlandish. Many had been examined ad nauseam, including by those at the reception, and roundly debunked. The collective anxiety that was palpable moments earlier melted away, as many saw the speech as another attempt to revive disproved theories unlikely to be taken seriously by most voters.

“Everyone just sort of guffawed and put their phones away and went to the bar,” recalled Quinn Raymond, co-founder of VoteShield, a nonprofit that works with states to help monitor voter registration data, who was at the event.

Still, if the speech made little impact, records published by the Trump administration to support the president’s claims damaged the already eroding relationship between CISA and state election officials. The material included raw information states had shared with the agency that was supposed to remain private, such as a log of communications from Election Day 2020 detailing activity being monitored in several states.

“It betrayed the trust of all partners who were willing to share information at the time,” said Geoff Hale, who worked on CISA’s elections team from the agency’s inception until last year. Now he specializes in election security at the Center for Democracy & Technology, a nonprofit that advocates for digital and civil rights.

Bis, the White House spokesperson, denied that the Trump administration broke any agreements in releasing the information. “The release of such information is exactly the sort of transparency news organizations should applaud,” she said. Bis also defended Trump’s speech, saying it had been fact-checked “by the agencies whose evidence was released and did not mischaracterize any information.”

Hale and others said the speech was one of several instances demonstrating the Trump administration’s reckless attitude toward sensitive data collected by CISA. Earlier this year, Politico reported that acting CISA Director Madhu Gottumukkala had uploaded records to ChatGPT, even though DHS had barred its employees from using the unsecure program. A CISA spokesperson told Politico that Gottumukkala had been permitted to use the technology for a “short-term and limited” basis.

Last May, an independent journalist named Brian Krebs exposed that CISA published private data, including passwords, cloud keys and other information, on its public GitHub page, in a folder labeled “Private-CISA.” A CISA spokesperson told the journalist there was no indication that sensitive data was compromised.

Some state election authorities were also alarmed to see the lengths to which the Trump administration went to legitimize the president’s fixation on the 2020 race.

In fall 2025, Missouri election officials produced a memo stating Andrew McCoy Warner, a Department of Justice official and prominent 2020 election conspiracy theorist, had called several clerks asking for access to voting machines. Tulsi Gabbard, then the director of national intelligence, had also led an operation in Puerto Rico to seize election machines. When the private cybersecurity contractor hired to examine the machines, Mojave Research Inc., failed to find evidence supporting claims about 2020, the federal government became “dissastified” with its services and stopped renewing its contract, its CEO later told reporters.

A spokesperson for the Office of the Director of National Intelligence told reporters in August that Mojave’s work ceased because it had completed its contract. Testifying before Congress in March, Gabbard said the seizing of voting machines came at the request of an assistant U.S. attorney in Puerto Rico.

“What happened in the second Trump administration is from almost day one — I mean, literally the first two months — they took all that was built up by Trump 1 and just decimated it,” said David Becker, founder of the nonpartisan Center for Election Innovation and Research, a nonprofit that works with state election authorities. “Election officials lost trust in the federal government.”

It didn’t help that, in his speech, the president mocked CISA’s defense of the 2020 election, calling the statement about it being the most secure in history a “very pat line” concocted as part of a deep-state cover-up. One former career CISA employee described being crestfallen at the Trump administration’s erosion of all they’d accomplished.

“We worked so hard to build that trusted relationship,” said Caitlin Durkovich, former DHS assistant secretary for infrastructure protection and co-founder of the cybersecurity firm Civira Partners. “I don’t know how you put it back together.”

A few weeks after Trump’s speech, the state election officials gathered once more, this time for a video call with Nick Andersen, who had replaced Gottumukkala as CISA’s acting director.

Though the primaries were already under way, this was the first time many had met Andersen, a former cybersecurity adviser to Trump’s White House who had joined CISA a year earlier. Andersen is also a district representative for the Republican Party in Virginia, according to the party’s website. In March, he gave a speech to the Fairfax GOP chapter titled “Fighting Democrat Redistricting.”

Speaking over video in August, the boyish-faced former Marine Corps engineer announced that DHS was preparing to release a plan on how it would work together with state officials to secure the election, according to five people who were present at the video meeting, some of whom shared notes with ProPublica.

Many on the call were stunned at what they perceived as a lack of understanding of election planning. Early voting for the general election was just around the corner. They had spent over a year preparing for the midterms, and there was no more time for ambitious work.

Some peppered Andersen with questions: Where had CISA been when there was still time to make improvements?

Andersen blamed any lapses or perceived breaches in trust on the federal government shutdown in fall 2025, twirling his pen uncomfortably and sipping from a Monster energy drink.

Fontes, Arizona’s secretary of state, was blunt about his feelings regarding working with Andersen and CISA, according to several of the people on the call.

“I told him I didn’t trust him,” Fontes recalled in an interview. “I did raise my voice a little bit, because I’m frustrated — very frustrated — that they would have the temerity to come in, clear the entire deck of competent professionals, stop supporting the states, eviscerate the coordination efforts that they had and then suddenly come in and say: ‘Oh, we’re from the federal government. We’re here to help.’”

Indeed, one recently departed CISA official said attempting to do the agency’s typical election work now would be futile. In previous years, CISA had finished almost all its preparations with the states by Labor Day.

“That ship has sailed,” the official said.

CISA published its security plan for the 2026 election on Sept. 24. The 13-page document describes how, over the past two years, CISA has “recommitted to its statutory mission and remains resolute in strengthening the security of elections.”

State officials said their planning will ensure a secure election, even without help from CISA. Yet they and cybersecurity experts worry that Trump will say the election was hacked if Republicans don’t win in November.

The security plan calls for “leveraging collaborative partnerships” with states the agency has abandoned since Trump took office. Shenna Bellows, Maine’s secretary of state, said she’d welcome that but was skeptical of the agency’s motivations.

“For CISA to promise election officials now, at this point in time, that they are going to be a resource for the 2026 election is too little, too late,” she said.

Jen Fifield contributed reporting. Mariam Elba contributed research.

]]>

Hundreds of federal websites lack key defense against spies, senator says

David DiMolfetta — Mon, 19 Oct 2026 11:00:00 -0400

Sen. Ron Wyden, D-Ore., is urging the Trump administration to close an encryption gap that could let foreign adversaries track visits to sensitive government websites, including the FBI’s tip portal and a veterans crisis line, according to a letter sent to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget on Monday and first seen by Nextgov/FCW.

Wyden asked CISA and OMB to require that agencies implement a web security standard that hides the name of the website someone is visiting. The protocol, known as Encrypted Client Hello, protects the website name when a user’s browser connects to a site and has been supported by major browsers and some web infrastructure providers since 2023.

Wyden’s office identified 350 federal web addresses that lack the encryption specification. They include sites that facilitate intelligence community job applications, immigration services, health information, and U.S. diplomatic websites around the world.

“This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies,” Wyden wrote to CISA acting director Nick Andersen and deputy federal chief information officer Thomas Flagg.

He also asked OMB, working with CISA and the Office of the National Cyber Director, to require that cloud and network providers support the technology to qualify for federal contracts. He requested responses by Nov. 20.

Nextgov/FCW has requested comments from CISA and OMB.

Federal websites generally encrypt the information people read or submit, though hackers can still learn which sites they visit by monitoring their internet traffic.

The letter singles out two services whose visitors could be particularly vulnerable.

The Department of Veterans Affairs’ Veterans Crisis Line platform uses Amazon Web Services, which does not currently support ECH for the site, according to the letter. Wyden warned that the exposure could help foreign adversaries identify veterans seeking mental health assistance. Additionally, the FBI’s tips.fbi.gov site uses Cloudflare, a provider that supports ECH, but the portal has not enabled it, the senator added, arguing the current arrangement could put people contacting the bureau at risk of identification.

The possible FBI exposure also comes after a prolific criminal hacker group recently stole troves of sensitive employee information tied to the bureau’s jobs portal.

The list of sites without the protocol also includes hotline.oig.dhs.gov, the DHS inspector general’s complaint hotline; civilrights.justice.gov, the Justice Department’s civil rights reporting portal; and apply.intelligencecareers.gov, an intelligence community recruitment site. Federal HIV information sites, including hivinfo.nih.gov and clinicalinfo.hiv.gov, are also listed.

To craft the list, Wyden’s staffers tested federal web addresses using third-party network providers to see if ECH successfully hid which specific websites were being visited, a spokesperson told Nextgov/FCW. The protection only appeared to work on sites relying on Cloudflare’s free service tier, the spokesperson added.

The letter does not establish that adversaries have tracked visitors to any of the listed addresses.

Wyden argued the government can close these gaps using technology already supported by major browsers and deployed across millions of websites. For agencies whose providers support ECH, enabling it can be as simple as changing a setting, he said.

“Modern federal zero trust cybersecurity practices rely on protective software installed directly on agency devices, so enabling [Encrypted Client Hello] would strictly improve the cybersecurity of federal networks,” Wyden wrote.

The effort follows his September call for NSA to update its advice about virtual private networks. A Congressional Research Service analysis requested by his office at the time warned that foreign intelligence services with broad visibility into internet traffic could potentially connect VPN users to websites by comparing traffic patterns.

]]>

Marines fielding new tech for prolonged medical care on the battlefield

Meghann Myers — Fri, 16 Oct 2026 15:51:04 -0400

The Marine Corps is preparing for a future battlefield on which the injuries are the same but the ability to quickly fly troops to a trauma hospital is very limited. To close that gap, the service is fielding new tech like mobile blood banks and ultrasounds, with a self-contained power source to keep them running.

The Expeditionary Medical Refrigeration Unit and Mobile and the MEQU mobile blood warmer were deployed to U.S. Central Command this year, where a unit set up a continuous mobile blood bank and sent their notes back to the Marine Corps on how to make it better, officials told reporters Friday during a media round table.

“We were told that the EMRU was instrumental to their ability to maintain a revolving blood bank to ensure that they had what they needed to be ready to care for injured service members,” said Navy Cmdr. Kyleigh Hupfl, clinic for Expeditionary Medical Systems.

The concept of the “golden hour,” the critical time period after a casualty that made all the difference in getting a wounded service member from the battlefield to hospital triage during the Global War on Terror, will be much more complicated in a near-peer fight.

While ground fighters could sometimes shoot down a medevac helicopter in Iraq or Afghanistan, an enemy with more sophisticated surveillance and missile technology will mean commanders have to wait to call in evacuations and work to stabilize casualties on site for much longer than in more recent conflicts.

“We're leaving the golden hour behind, and we're moving toward those longer patient-care hold times,” said Col. Paul Gillikin, program manager for Combat Support systems. “Again, fully recognizing the future fight against a peer competitor, over those great distances in the Pacific—we know that we're not going to have the developed [forward operating bases], the full mobility, the Iron Mountain.”

The No. 1 cause of battlefield death is severe bleeding, so being able to not only slow bleeding but give transfusions on site will be crucial.

“We need to be able to bring cold-chain distribution forward without relying on heavy generators, and we need to be able to do that in a sustainable way. We need to be able to warm that blood so that we don't get that patient in a worse-off situation,” Hupfl said. “We need to be able to see, after that, whether they have continued bleeding, so that the commander can make a risk decision on putting an evacuation asset at risk to get that patient out.”

That’s where the battery-powered EMRU and the associated blood warmer come in, as a mobile system that keeps blood products refrigerated, then heats them to body temp for quick transfusions. The Corps is also fielding the KOSMOS point-of-care ultrasound to assess internal bleeding, and the Marine Corps Squad Power Manager medical kit variant to keep them all running.

“We expect in the Marine Corps to be in distributed environments, where the evacuation will be delayed or contested,” said Brig. Gen. Tamara Campbell, deputy commander of Portfolio Acquisition Executive Marine Corps. “And so the equipment that we're looking at is to take that into account, regardless of the time it takes to apply that care. We need to do that at any time so that any of our soldiers, sailors, Marines—anybody that's within our operating environment needs that level of care.”

]]>

Meet the agency using AI to screen grant applicants for links to potential adversaries

Edward Graham — Thu, 15 Oct 2026 14:51:00 -0400

The Department of Transportation has been using artificial intelligence to determine whether grant recipients have ties to adversarial nations, an agency official said on Wednesday.

The federal government has taken a variety of steps in recent years to limit hostile foreign governments’ access to American research, including restricting access to individuals or entities connected with countries like Iran or Russia. As the U.S. seeks to maintain its dominance over China in the global tech race, the Trump administration and Congress in particular have also been tightening the rules on collaborating with organizations or scientists who could conceivably share sensitive technologies or information with Beijing.

It’s not easy, however, for officials or research institutions to unravel these threads, particularly when bad actors are surreptitiously working on behalf of nation states. But new capabilities could help to better chart these connections.

Neil Chaudhry, senior advisor for AI at Transportation, said his agency has worked with partners to create “some really robust AI tools” to analyze the recipients of its research grants.

“When we get to a down-select from grants that are some really promising research projects, we sort of do a deep dive on the [principal investigators] in the grant that says … do they have direct links to the [Chinese Communist Party] leadership, or do they have links to Russian oligarchs?” Chaudhry said during a panel at the SAP Public Sector Summit in Washington, D.C.

“What we don't want to do is go on a fishing expedition,” he said, adding that identifying these kinds of relationships is “not based on the color of their skin and their nationality or something,” but on factors such as whether an individual or entity may be receiving funding from questionable sources.

“If it's a company that's funded by a [venture capital firm] in Silicon Valley, that VC is probably funded by another VC in the Middle East or in Malaysia, and that VC is then wholly funded by the Chinese industrial bank,” Chaudhry said. “And then when that startup goes out of business, we don't know what just happened to that IP that the U.S. government spent money developing.”

Transportation did not respond to a request for comment by the time of publication.

Transportation’s latest AI use-case inventory, which was published earlier this year, does not include the research grant-focused capability. Although other agencies have been using automation or more in-depth analysis tools to identify potential connections to foreign adversaries, Transportation’s use of AI seems to be relatively unique.

A November 2024 report from the Government Accountability Office found that reviewed agencies had taken a variety of steps to comply with federal requirements mandating that they better identify foreign risks in the Small Business Innovation Research and Small Business Technology Transfer programs. GAO noted that the programs, which were created to allow U.S. small businesses to engage in federally funded R&D, “face risks of foreign actors seeking to illicitly acquire federally funded research and technologies.”

The watchdog noted at the time that some agencies — like the Air Force, National Science Foundation and NASA — were taking some steps “either to automate the processing of due diligence disclosure forms or support the vetting of applicants and identify associated risks.”

]]>

Trump admin's retreat from foreign-influence fight is weakening US defenses, sources say

David DiMolfetta — Wed, 14 Oct 2026 14:00:00 -0400

The Trump administration’s retreat from programs that track foreign influence operations has weakened various cross-sector relationships used to identify and confront those campaigns as midterm elections fast approach — even as artificial intelligence makes those operations easier to deploy — multiple sources told Nextgov/FCW.

State officials say they are receiving fewer election-specific federal briefings than in previous cycles, while others who track foreign influence have observed routine exchanges with government and technology companies fall away. Some also note that federal workforce departures have weakened cooperation with outside partners, including social media platforms, to track false information online.

While the federal government continues to gather intelligence on foreign threats to U.S. elections, some of those who lean on those findings say federal agencies are less reliably sharing information with non-federal researchers and state officials responsible for countering those campaigns. That cooperation began to weaken before President Donald Trump returned to office, and his administration has since dismantled several programs dedicated to countering the problem.

This story is based on interviews with current and former federal officials, state election officials and specialists in cybersecurity and influence operations. Several people spoke on the condition of anonymity to be candid about their views and for fear of retribution. Their concerns come as fast-evolving AI tools now allow foreign influence operators to do more than just generate fake images or audio, instead helping them produce plausible-sounding messages, find audiences to target and autonomously adjust campaigns at a scale not seen before.

The Cybersecurity and Infrastructure Security Agency referred questions about foreign malign influence to the Justice Department, saying that influence operations fall outside CISA’s mission. DOJ did not immediately respond to a request for comment.

“Election security is national security, and protecting our critical infrastructure remains a top priority for the Trump Administration, DHS, and CISA,” a CISA spokesperson said. “CISA works closely with intelligence and law enforcement partners to monitor threats to U.S. critical infrastructure, including election infrastructure.”

The spokesperson added that the agency is committed to supporting state and local election officials “to protect election infrastructure and safeguard our democracy.”

The Office of the Director of National Intelligence did not respond to a request for comment.

Foreign influence operations aim to shape what people believe and how they act, often without revealing who is behind the message. Around elections, that can mean spreading false voting information, stoking political divisions or casting doubt on results. Such messages can be harder to question when they appear to come from or be amplified by fellow Americans and reinforce views people already hold.

One election nonprofit official told Nextgov/FCW that, during the November 2024 election, they received an early-morning text from a colleague in Georgia asking about bomb threats at voting sites, which U.S. officials later deemed may have been tied to Russia. The official was sitting in CISA’s election operations room. Finding out whether other jurisdictions were facing similar threats meant simply walking across the room and asking federal personnel.

“Any time you have federal support to help connect the dots, it’s a game-changer,” the official said, noting that they have not been alerted to or invited to a CISA elections operations room for the coming midterms.

The CISA spokesperson said that, before and during Election Day, the agency will “activate an Incident Coordination Group to establish a unified operational picture, rapidly share critical information, coordinate essential services for stakeholders in the field and strengthen incident response within its mission and authorities.”

Bret Schafer, senior director of policy and research for information operations at the Institute for Strategic Dialogue, said efforts to bring government, technology companies and researchers together grew during Trump’s first term, after Russia’s interference attempts in the 2016 election exposed gaps in their understanding of foreign campaigns.

Each could see activity the others could not. Sharing those findings helped them recognize operations that might otherwise go unnoticed, Schafer said last week on a panel at a national-security law conference hosted by the American Bar Association.

Those routine exchanges with the government have become harder to sustain. Now, “civil society is out on both sides,” he said, adding that he had gone at least two years without an information-sharing conversation with a relevant technology company, and a couple of years without one involving the government.

Much of that cooling began in the Biden administration, when GOP litigation over federal interactions with social media companies made participants more cautious. The Trump administration has gone further. It shuttered CISA work focused on election disinformation, disbanded the FBI’s Foreign Influence Task Force and closed the State Department’s office for countering foreign information threats, all largely on censorship grounds. The ODNI Foreign Malign Influence Center also faced a similar fate last August under then-director Tulsi Gabbard.

An office can retain its responsibilities while losing the relationships that helped it do the work, according to a person familiar with U.S. efforts to address influence operations. But someone who once knew exactly whom to call may find that their counterpart has departed, or that the people still there are unsure whether leadership supports exchanging information.

One current U.S. official described an environment that puts less public emphasis on election security at CISA and across the Department of Homeland Security than in previous cycles, with greater attention to other critical infrastructure matters, including water systems.

The official speculated that employees could hesitate to highlight their election security work after seeing others who worked on elections lose their jobs, though they noted they had not heard staff express that fear directly. The official also acknowledged that midterms generally receive less attention than presidential elections.

The administration has maintained that federal support continues. ODNI has assigned officials to coordinate election threat intelligence, while CISA outlined election support plans last month. Defense Secretary Pete Hegseth also directed Cyber Command and military intelligence agencies to prioritize foreign election threats and coordinate with the Department of Homeland Security last month.

A current Defense Department analyst argued that closing offices focused on tracking influence operations does not necessarily erase expertise, because personnel can continue the work elsewhere in government or as contractors. But it’s unclear how much of that work has continued, or whether those who left government still have access to relevant information and federal contacts they once relied on.

The analyst recalled a strong working relationship with Meta, which operates Facebook and Instagram, when they worked on those issues around two years ago. The analyst could not say whether those exchanges continue today.

Similarly, one former U.S. official recalled preparations for the 2020 election beginning roughly a year before Americans went to vote, with coordination growing more frequent as Election Day approached. Some calls included 80 to 100 participants, including private companies, discussing topics that included ballot security and broadcasting accurate voting information.

“Our nation’s security is best protected when private individuals, private sector, industry and government work together toward a common goal to protect our freedom and way of life, and that includes reporting suspicious and illegal activity and leveraging legal access and authorities to protect the American people and interests,” Erin Joe, special counsel at Wiley Rein LLP and a former senior FBI executive, told Nextgov/FCW in an interview.

At the ABA conference, former DHS Secretary Michael Chertoff argued that the government still has a role in helping people recognize deception. Officials can explain where a message came from or show that a supposed recording was generated by AI, without telling people which political views to accept.

“It is fighting bad speech with good speech,” Chertoff said.

A TikTok spokesperson referred Nextgov/FCW to a webpage outlining steps the company is taking to prepare for midterms and disrupt covert influence operations on its platform. Several other social media companies and AI firms — including Meta, X, Anthropic and OpenAI — did not respond to requests for comment.

Two state election officials described how their offices are responding to misleading information while receiving fewer election-specific federal briefings than in previous cycles.

One said identifying who is behind false messages can be difficult. Their office often focuses on information that could confuse people about when, where and how to vote, as well as threats to election workers.

When a misleading claim surfaces, communications staff and leadership decide whether responding would help voters or draw more attention to something that might otherwise fade away. Threats to election officials are referred to law enforcement, the official said.

The same official said they had not received an election-specific federal briefing “in quite some time,” although they attend regularly held CISA calls about software vulnerabilities and known flaws being exploited by hackers. Those discussions offer little information that is specific to elections, the official said. Monthly meetings through the state’s fusion center still bring together state, local and federal law enforcement to discuss threats to election officials.

The second official said their office sends a representative to federal election-threat briefings whenever they are available, but those briefings have occurred less frequently than in 2024.

That official nevertheless described their election offices as better prepared than in past years, with multiple backup plans, in case disruptions occur.

“We hope that we don’t have to use them. But if we do, they’re there,” the official said.

Those preparations come as AI has lowered the cost and effort required to conduct influence campaigns. AI has played a key role in helping to run these operations, from writing posts and distributing them to studying how people respond, said Snehal Antani, CEO and co-founder of cybersecurity company Horizon3.ai. Operators can test different messages and use the results to adjust their approach, and AI agents can automate much of that work, reducing the time and expertise it once required, he said.

“AI has dramatically reduced the skills required and dramatically accelerated the speed at which this cycle can be executed,” Antani said.

Another former U.S. official added that increasingly capable, downloadable open-source models allow smaller actors to undertake work that once required substantial investment and specialized engineering.

“The barrier to entry is much lower,” the former official said, adding that AI-generated text can blend into everyday online conversations and make it harder to spot than a manipulated image or video with visible flaws.

Russia is more likely to pursue more obvious inflammatory messaging this cycle, while China’s efforts may be more covert to serve longer-term objectives, said another current official, adding that both are expected to make greater use of AI. Pro-Iran outfits have especially leveraged AI more overtly in recent months amid the war that began in late February.

But the official cautioned that more powerful AI tools and more convincing content do not necessarily mean a foreign operation is changing how people vote. An image or video getting lots of views does not mean people believe it or will vote differently because of it, they added.

In some cases, an influence campaign may not even target eligible voters. For instance, content aimed at younger Americans could sway their political stances, but they may not be of legal age to cast a ballot.

And in other settings, a foreign influence operation may not be needed for an American to vote a certain way.

“If I see gas is $7 a gallon, I don’t necessarily need a lot more to go vote blue,” the official said, referring to California voters who have faced record-high fuel prices in some parts of the state.

These foreign threats come as political campaigns at home have increasingly used AI in their advertisements.

The growing use of AI-generated political videos could also make it harder to distinguish real footage from fabricated material, according to research released Wednesday by cybersecurity firm Check Point.

“Video is one of the easier ways to make a claim feel real, since people tend to trust what they can see and hear for themselves,” the company’s findings say. As AI-generated political content becomes more common, it becomes harder for voters to “trust that a video of a candidate is real” and easier for anyone “to dismiss a real video as fake.”

The scale and sophistication of false information today “makes our sensitivity to it a little bit more dull than perhaps in years past,” said Kimberly Kearney, a former CIA case officer.

“We as individuals have to have the desire to know whether what we’re consuming is true or false, or if it feeds into a narrative that is convenient or more comfortable for us,” she said in an interview. “So it starts with that cognitive honesty and awareness to want to know whether what you’re consuming is accurate or if it could have a bias to it.”

]]>

FBI disrupts North Korean 'laptop farms' used to fund weapons programs

David DiMolfetta — Tue, 13 Oct 2026 17:00:00 -0400

The FBI searched more than 40 Texas residences and seized 187 laptops and other devices used to help North Korean operatives obtain remote jobs at U.S. companies under false identities, federal prosecutors announced Tuesday.

The effort, dubbed Operation Lonestar Roundup, targeted “laptop farms” that housed employer-issued computers and allowed workers overseas to access them remotely. U.S.-based facilitators configured the devices and transferred earnings to North Korean-controlled accounts, according to the Justice Department.

CrowdStrike, which provided intelligence and technical analysis to support the FBI’s work, said the broader operation affected a campaign targeting more than 70 U.S. companies and included two arrests in Ohio. The company did not identify those arrested or describe the charges in its announcement to reporters. The Justice Department’s Texas release did not address the Ohio arrests.

The scheme gave North Korean workers access to corporate systems while generating revenue for the regime’s sanctioned weapons programs, authorities said. By routing their work through computers physically located in the United States, operatives could conceal that they were working abroad.

“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” FBI Dallas Special Agent in Charge R. Joseph Rothrock said in a statement.

The 187 devices seized in Texas included laptops and keyboard-video-mouse equipment, which can be used to control computers remotely. About 100 devices were recovered in North Texas, according to prosecutors.

CrowdStrike tracks the network under the moniker Famous Chollima and said its work with the FBI disrupted several U.S. laptop farms in late September. Organizations identified in the disrupted operations included businesses in aerospace, energy, financial services, health care, cybersecurity, defense engineering and government technology, the company said.

CrowdStrike described several ways operatives diverted employer-issued computers to the farms. Some filed false police reports claiming their laptops had been stolen so employers would ship replacements to different addresses. Others claimed last-minute moves or obtained jobs through staffing firms, allowing equipment to be redirected without those firms’ knowledge.

Once the computers arrived, facilitators installed hardware and software that enabled overseas workers to operate them, according to CrowdStrike. The company said operatives also disguised equipment used in the scheme to make it harder for security teams to detect.

The action adds to a series of federal investigations into North Korea’s use of fraudulent IT employment to raise money and gain access to sensitive information.

Last June, DOJ announced actions involving searches of 29 known or suspected laptop farms across 16 states. In one case, prosecutors alleged that an overseas worker accessed and stole export-controlled technical information from a California defense contractor developing artificial intelligence-powered equipment. A senior FBI official said at the time that at least one U.S. government contractor had been caught up in the fraudulent hiring schemes.

The schemes have reached direct federal hiring pipelines. In a case disclosed in May 2024, participants tried to obtain contractor positions at Immigration and Customs Enforcement and the Federal Protective Service but could not meet fingerprinting requirements, according to an indictment. Another participant secured a contractor position at the General Services Administration but was terminated five days after an introductory meeting.

The latest seizures are unlikely to end broader DPRK operations. CrowdStrike said the disruptions would probably slow activity primarily in the areas where farms were shut down and were unlikely to have lasting effects, as operatives adapt their techniques to avoid detection.

The Justice Department said the investigation remains ongoing.

]]>

US Army to stage counter-drug training exercises in South America

Meghann Myers — Mon, 12 Oct 2026 19:42:20 -0400

The Army is looking to refocus its U.S. Southern Command exercises to focus on counter-cartel operations, Gen. Joe Ryan, who heads Army Western Hemisphere Command, said Monday at the Association of the United States Army annual meeting in Washington, D.C.

The move is part of the nascent command’s mission to build a “theater Army,” Ryan said, above and beyond the largely partner training and disaster response missions its U.S. Army North and South predecessors maintained.

“I think what you're going to see ,where we've perhaps done some exercises in the past that were relationship-building exercises to a point, we are going to focus our exercise program going forward to really be focused on those things that contribute to the counter designated terrorist organization threat and cartel threat in the region," he said.

Ryan said the review was directed by SOUTHCOM’s commander, Marine Gen. Frank Donovan, “to better align with current federal priorities and strategy.”

Those priorities include the latest National Defense Strategy’s shift that puts defending the homeland at the top of the list, with the Western Hemisphere as the Pentagon’s priority theater, a concept dubbed the “Donroe Doctrine.”

That focus on SOUTHCOM gave rise to the administration’s strikes on suspected drug trafficking boats in the Caribbean and the raid to capture Venezuelan President Nicolas Maduro.

“Make no mistake; these are designated terrorist organizations," Ryan said. "They are global economic syndicates that have created a business model that is survivable, has survived over decades, and will continue to survive unless we disrupt the economic side of it."

At the same time, the Army is also beefing up its ability to do the legacy mission of crisis response in SOUTHCOM, Ryan said. The service recently got approval to move more aviation assets and personnel down south, to help move people and supplies.

"We're going to grow that footprint down there, where it's a relatively modest footprint to date, given the responsibilities it's tended to, and we're going to give them more aircraft, more crews, more maintainers here over the next couple of fiscal years, to help them address some of the natural disasters and threats in the region," Ryan said. "Because those things become absolutely critical when you're talking about moving supplies, moving people to the point in need, and making assessments."

]]>

Army activates sustainment brigade as part of Pacific restructuring

Jennifer Hlad — Wed, 07 Oct 2026 22:06:11 -0400

The Army shuttered one Okinawa-based support unit and reactivated a larger one, part of the broader effort to prepare for a potential conflict in the expansive theater.

The closure of the 10th Support Group and the reestablishment of the 45th Sustainment Brigade will give the service a brigade-level headquarters that can better command and control sustainment capabilities in the region, said Col. Dennis Han, who leads the new unit. It will also mean a “small growth” in the number of soldiers at Torii Station, but no additional infrastructure at the base on Okinawa’s west coast.

While the 10th Support Group was focused on providing logistics support within Japan, the change to 45th Sustainment Brigade broadens the aperture to the entire Pacific.

The Army is “heavily investing in the emerging requirements here,” and this is part of the service’s response, Han said. “Over the next couple of years, we’re looking forward to building our staff, building our capacity to be prepared for whatever comes our way.”

Maj. Gen. James Dooghan, commander of U.S. Army Japan, said in a release that the ceremony was "more than casing one set of colors and uncasing another. ... It is about continuity and transformation, ensuring our Army is positioned to sustain the force wherever and whenever it is needed."

Sustainment is a perennial topic at regional conferences. At AUSA’s Land Forces Pacific in May, U.S. Indo-Pacific Command leader Adm. Samuel Paparo noted that the Army “delivers foundational sustainment capabilities to the entire joint force. And I’m fervent in my belief that nobody knows or senses or feels viscerally the scale of sustainment than our nation’s Army.”

]]>

Recent Taiwan simulation highlights US cyberdefense gaps against China, experts warn

David DiMolfetta — Wed, 07 Oct 2026 11:59:00 -0400

The United States devotes too little attention toward preparedness for a Chinese campaign of cyberattacks and economic pressure against Taiwan, organizers of a recent war game warned Tuesday, arguing that gaps between military and civilian planning could delay assistance to the island.

The Foundation for Defense of Democracies exercise examined how Beijing could disrupt Taiwan’s communications networks to extract political concessions without launching an invasion. The simulation was held in Taiwan in late September, and its findings were briefed to Taiwanese President Lai Ching-te and his national security team, according to the think tank.

Mark Montgomery, an FDD senior fellow and retired Navy rear admiral who helped lead the exercise, said Washington routinely rehearses possible military conflict over Taiwan but is less systematic about preparing for the cyber operations he considers more likely to occur.

“The Department of Defense sees it as a problem for the other federal agencies, and the other federal agencies don’t have a budget or a systematic process for running these kinds of tabletops,” he said in a briefing with reporters.

The exercise began with localized cellular disruptions, information manipulation and pressure on satellite connectivity. A second phase escalated to damaged undersea cables, disabled electrical substations supporting telecommunications and strained backup networks, according to Craig Singleton, FDD’s China program director, who played China in the simulation.

The aim was to make daily life less reliable and undermine confidence in Taiwan’s government while avoiding a direct confrontation with the United States, Singleton said. Communications outages could also compound problems in other sectors, disrupting payments, slowing emergency coordination and making power failures harder to manage.

Taiwanese participants rerouted traffic and activated alternatives. But the harder test was whether those systems could sustain services for weeks as Beijing studied the response and targeted the backups, he said.

Asked by Nextgov/FCW about lessons from Salt Typhoon, the Chinese hacking campaign that breached U.S. and global telecommunications networks, Singleton said that operation informed the scenario, but it wasn’t named directly in the exercise packets.

A separate Chinese hacking collective dubbed Volt Typhoon—which seeks to establish access⁠ to critical infrastructure for disruptive or destructive attacks during a major crisis or conflict—was also not mentioned directly, but its activities also influenced the war game.

“If an adversary already understands the network, its dependencies and its fallback pathways, then disruption can become much more targeted and adaptive,” Singleton said.

Montgomery said policymakers also tend to underestimate recovery times for systems that are taken down, especially when restoring one service depends on bringing others back online. He described that as a recurring problem in exercises across several countries.

“You know they’re speaking in minutes and hours, and my experience is days or weeks,” he said.

The warnings underscore the range of threats Taiwan faces beyond a possible Chinese invasion. In its 2026 worldwide threat assessment⁠, the Office of the Director of National Intelligence said Chinese leaders did not currently plan to invade Taiwan in 2027 and had no fixed timeline for unification. Beijing preferred achieving its goal without force, the assessment said, while continuing to develop military options.

More recently, U.S. officials have assessed an invasion before 2028 as increasingly unlikely⁠, citing military readiness delays and China’s interest in Taiwan’s next presidential election.

China claims Taiwan as its territory, although it has never governed the self-ruled island, and views bringing the island under its control as central to national unification. China has not ruled out using force, but cyberattacks and economic pressure could offer ways to weaken Taiwan’s resistance and push its leaders toward concessions without the risks of an invasion.

Montgomery separately warned that early 2028 could bring intensified cyber and economic coercion if Taiwan’s Democratic Progressive Party wins a fourth consecutive presidential election. FDD hopes to run future exercises with congressional staff and federal agencies, he added.

]]>

Pentagon, FBI personnel-data breaches raise questions

David DiMolfetta — Mon, 05 Oct 2026 14:00:00 -0400

A Pentagon breach that exposed sensitive personnel information for months is raising questions yet again about federal agencies' ability to detect unauthorized access to their records.

Information about roughly 3 million people was potentially exposed from October 2025 to July 16, 2026, by a breach of a file-sharing system at the Defense Manpower Data Center, which maintains personnel information used across the military and other government agencies.

“Three million people may be the headline, but months of unauthorized access to highly sensitive data going undetected is the real warning,” said Nitay Milner, co-founder and CEO of data security company ORION Security.

Nextgov/FCW obtained a copy of the letter, which was signed by DMDC Director Katie Griffin. The accessed files contained unencrypted personal information, including Social Security numbers and, depending on the individual, names, birth dates, contact information and military occupational specialties.

“Upon discovery of the security vulnerability, DMDC immediately initiated privacy and cybersecurity incident response actions in accordance with Office of the Management and Budget and [Defense] Department guidelines and policies,” Griffin wrote. “We are taking appropriate actions to assess and enhance the cybersecurity posture of the DMDC system.”

DMDC patched the flaw and restored the system, according to the letter, and affected individuals are being offered a year of credit monitoring and identity-restoration services.

Military Times first reported the incident late last month, citing the same notice. A defense official later told CNN that the breach affected 2.76 million living people and another 294,000 deceased individuals.

The disclosure comes as the FBI responds to a separate breach claimed by prolific cybercrime group ShinyHunters, which likely exposed sensitive records of personnel involved in intelligence-gathering roles.

No public evidence has linked the intrusions, though both cases involve information that could help attackers identify government personnel and tailor attempts to deceive them through fraud schemes. Such data can also identify employees whose work is of particular interest to foreign intelligence services.

The breach is hardly the first to expose weaknesses in federal systems in recent years. In December 2024, Treasury disclosed that Chinese state-sponsored hackers accessed unclassified documents through a compromised remote-support service. Separately, the federal judiciary acknowledged attacks on its electronic case management system in August 2025, and the Congressional Budget Office confirmed unauthorized access to its systems that November.

AI systems are widely expected to accelerate cyberattacks, helping hackers find security weaknesses and use stolen personal information to make their targeting more precise and convincing.

Milner said detecting unauthorized activity requires agencies to understand who is gathering sensitive information, whether they are permitted to enter a given system and whether their behavior makes sense.

That scrutiny can matter even when an intrusion doesn’t immediately disrupt a system or draw attention. In the case of DMDC, the department’s notification described access spanning roughly nine months before the vulnerability was discovered.

Jeff Wichman, senior director of breach preparedness and response at Semperis, said agencies must plan for intrusions even when they have experienced security teams and established protections.

“The FBI and Pentagon have amazing responders, but these breaches are still happening and eventually everyone is hit,” he said. “True resilience depends on having a fully pressure-tested incident response plan detailing exactly which teams are responsible for what across the entire breach cycle, from initial discovery and containment to legal and regulatory reporting.”

He also warned that new government AI services, including the America.gov chatbot, could create more ways for attackers to reach sensitive information if those tools connect to agency systems. “More government agencies will fall victim to compromise,” he said. “Every piece of leaked data creates a domino effect.”

]]>

China-linked hackers posed as former US officials, Anthropic employee to target AI experts

David DiMolfetta — Thu, 01 Oct 2026 05:00:00 -0400

Chinese hackers impersonated a former senior White House technology official, a former State Department economist and a senior Anthropic employee in attempts to break into the cloud accounts of artificial intelligence policy experts, according to findings from cybersecurity company Proofpoint released Thursday.

The campaigns targeted researchers at think tanks, universities and law firms, using invitations to advise on AI policy and export controls to start conversations. Once recipients responded, the attackers sent links designed to steal their Microsoft login credentials, per the findings.

Among those impersonated were Lynne Parker, a former principal deputy director of the White House Office of Science and Technology Policy, and Heidi Crebo-Rediker, who served as the State Department’s first chief economist.

Proofpoint connected the activity to a group tracked as TA419, describing it as a China-aligned outfit supporting Beijing’s intelligence interests. The report doesn’t say how many people were targeted, whether any accounts were successfully compromised or if the attackers obtained any information.

Beginning July 8, the hackers posed as Parker and then Crebo-Rediker in messages inviting AI experts to join a fictitious “AI Policy Advisory Committee” or contribute to a purported Senate Foreign Relations Committee report on AI export controls and supply chains. Parker’s White House roles included assistant director for AI and founding director of the National AI Initiative Office. Crebo-Rediker, now a Council on Foreign Relations senior fellow, previously worked as the Senate Foreign Relations Committee’s chief of international finance and economics.

After a recipient engaged with the initial messages, the attackers followed up with correspondence that directed targets to a fake OneDrive page used to attempt the account theft.

The group had also used a similar approach in February, impersonating a senior Anthropic employee in an email to an AI policy analyst at a U.S. think tank, Proofpoint said. The subject line read, “Request for Feedback on Military Integration of Claude,” invoking ongoing debate over military use of the company’s AI models. The research did not name the impersonated employee.

The hackers have “consistently shown an interest in defense, national security, energy, international relations, and foreign policy targets, predominantly with a nexus to the U.S. and Japan,” the report says. “The targeting of AI policy experts represents an extension of that remit rather than a departure from it.”

In an email to Nextgov/FCW, Parker confirmed that she learned of the impersonation on July 9, when two recipients contacted her through separate channels to ask whether she had sent the emails. She told them the messages were fraudulent and alerted other colleagues.

“The challenge is that, without knowing who the bad actors are targeting, it’s difficult to reach everyone who might be at risk,” Parker said.

“It is personally troubling to see the trust and relationships I’ve built over my career exploited to deceive others,” she added. “Targeting people in the field can be a way to gain access to valuable information and networks. Protecting America’s AI leadership requires protecting the people and institutions behind it and recognizing that trusted relationships can themselves become a target.”

Crebo-Rediker and Anthropic did not respond to requests for comment. China’s embassy in Washington, D.C., was also contacted. Chinese officials have routinely denied allegations of state-backed hacking and espionage.

The decision to target policy researchers highlights expanding intelligence threats in the global AI race between the U.S., China and other nation-states. Access to experts’ accounts could expose private discussions and professional contacts relevant to decisions about AI’s development, military use and sale abroad. The cyberspies’ approach also illustrates how attackers continue to exploit the dynamics of routine professional exchanges for information-gathering.

The findings also come as AI companies gain an increasingly direct role in Washington’s debate over how to oversee the fast-evolving technology. President Donald Trump met with industry leaders Tuesday to endorse voluntary AI safety commitments. Anthropic CEO Dario Amodei also had dinner with Trump on Sunday.

Proofpoint found that the attackers registered web addresses impersonating the Heritage Foundation, Japan’s defense minister Shinjiro Koizumi and the Japan–Taiwan Exchange Association. Posing as those figures and organizations could help the hackers convince experts that a malicious email is worth their time.

“At the end of the day, humans are our best line of defense,” Don Styer, a former Navy Supply Corps officer and executive vice president for federal services at Consulting Solutions, said in an interview. Attackers can exploit trust through impersonation or seemingly routine requests, he said, adding that foreign adversaries value intelligence they can’t find in public sources and may combine seemingly innocuous details to build a larger picture of a target.

Professional outreach has long been used as an intelligence tool. Nextgov/FCW reported in January that a suspected Chinese spying outfit approached a former senior State Department official last year with an offer to pay for research on U.S. policy toward Venezuela.

The International Consortium of Investigative Journalists reported in June that its reporters received suspicious consulting offers after publishing an investigation into China’s transnational repression. Separately, Britain’s MI5 on Wednesday accused the China General Technology Research Institute of funding academic work to improve Chinese intelligence capabilities. Over 100 U.K.-based academics had contributed to its projects, including research involving AI and cybersecurity, according to the agency, which added that many participants may have been unaware of the institute’s intelligence ties.

The targeting comes amid broader U.S. concerns about Chinese efforts to siphon American AI capabilities. Early last month, the NSA and other agencies accused Chinese developers of conducting large-scale distillation campaigns that use responses from advanced U.S. models to train competing systems.

The attackers revealed in Proofpoint’s findings “will likely continue targeting think tanks and policy experts working on technologies, and in geographies, of particular interest to the Chinese government” and will “likely also continue spoofing the identities of real subject-matter experts,” the company said.

]]>

Pentagon update on National Defense Strategy cites progress, omits key threats

Patrick Tucker — Wed, 30 Sep 2026 00:41:40 -0400

The Pentagon’s latest report about its implementation of the National Defense Strategy notes progress on accelerating weapons production, cutting red tape, and persuading European governments to boost defense spending—but is light on problems such as Russia’s increasing aggression in Europe and the high cost of U.S. wars in the Middle East.

The report to Congress, dated Sept. 22 but pushed out on Defense Department social media on Tuesday, argues that the Trump administration has made “significant progress implementing the 2026 National Defense Strategy’s guidance” in several areas. It cites a historically large budget request that includes funding for undersea forces, long-range air forces, long-range ground fires, and satellites for communication and intelligence; and $53 billion to accelerate the development of munitions.

The report arrives one day before Defense Secretary Pete Hegseth’s scheduled “State of the Force” address at Marine Corps Base Quantico in Virginia. He is likely to talk about some of the update’s key themes, according to one person familiar with the matter.

The update cites progress made in the Golden Dome for America, or GDA, effort to build a continental defense against drones and missiles. “DoW has already conducted our first live-fire event, during which we successfully demonstrated key aspects of GDA command-and-control (C2) as well as integration of other key capabilities,” it says.

The update says the Pentagon has worked with the Federal Aviation Administration and the Federal Communications Commission to ease the development and testing of counter-drone defenses. “We have created a first-of-its-kind process for the rapid coordination and safe incorporation of next generation C-UAS technology” into the National Airspace System, it says.

The update touts the administration’s effort to persuade European allies to spend more on their militaries and contribute more to plans for the continent’s defense. At least one alliance defense leader—Paweł Ksawery Zalewski, secretary of state at Poland’s Ministry of National Defence—has said the NATO 3.0 concept should not be misunderstood as a harbinger of a U.S. retreat from the alliance. “Polish armed forces and American armed forces have never been so close and so good and so deep as today,” Zalewski told a U.S. audience last week.

But the report glosses over conditions that have worsened since the National Defense Strategy was published in January—in part, because of President Trump’s decision to start a war on Iran.

For instance, while the NDS holds as a goal the replenishment of the U.S. arsenal, the new report doesn’t mention that Operation Epic Fury and other Middle East operations have set back that goal by “'months and years,” as a report from the Center for Strategic and International Studies put it in May. Nor does the report mention the NDS’ warning against “endless wars, regime change, and nation building”—the latter two being among the many justifications given by the Trump administration for its war on Iran.

It skips the fact that the NDS said regional allies should deter Iran and that it said further military action to prevent an Iranian nuclear weapon would be unnecessary in the wake of June 2025’s “Midnight Hammer” bombing.

Instead, the update asserts that the Defense Department “anticipated that such a need [for strikes against Iran’s nuclear program] might be forthcoming.”

But perhaps the report’s most significant omission, which it shares with the NDS itself, concerns Russian actions: hybrid and kinetic action against NATO members, military assistance to Iran, and intensifying the war on Ukraine.

Instead, the update notes that the United States reduced the number of manned brigade combat teams in Europe from “five to three, returning us to the level of BCTs in Europe in 2021.”

Max Bergmann and Otto Svendsen, writing for the Heinrich Böll Foundation on Sept. 24, say that “a potential U.S. force posture reduction in Europe will leave the continent vulnerable to further Russian aggression.”

]]>

After 40 days of combat, Navy destroyer returns home

Jennifer Hlad — Tue, 29 Sep 2026 13:38:00 -0400

JOINT BASE PEARL HARBOR-HICKAM, Hawaii—Some 300 days after leaving Hawaii, the guided-missile destroyer Frank E. Petersen Jr. was welcomed home Monday with delighted cheers, jangling cowbells, handmade posters, and fresh flower leis.

The ship—part of the Abraham Lincoln carrier strike group—did 40 days of combat operations and spent six months in an active combat zone. It started its deployment in December with operations in the South China Sea, but in late January was redirected to the Middle East, shortly before President Donald Trump launched Operation Epic Fury.

The Petersen took part in the war’s initial strikes on Iran, firing Tomahawk missiles at land targets on Feb. 28. Then, as the strike group’s air and missile defense commander, the destroyer warded off more than 100 Iranian missiles and drones launched against its group and other ships in the region.

We made sure that we kept dozens of ships safe against a variety of different attacks—missile attacks, drone attacks,” said Capt. Casey Mahon, the ship’s commander.

The destroyer, commissioned in 2022, sailed more than 85,000 nautical miles during the deployment and conducted 45 replenishments at sea. At one point, the ship spent 106 days at sea between port calls, Mahon said.

It also was the first ship to enter the Strait of Hormuz after the end of major combat operations, he said, which was “quite a voyage.”

“Obviously there was stress we had to face when we did that…on the sea, under the sea, and in the air.”

Though some of the adversary technology the crew faced was new, he said, “air defense really hasn’t changed a lot of ways since World War II: You have a radar, you find the thing, you’ve got to track it.” Still, “how these things fly, how they do their missions are very different, and so the crew showed a lot of adaptability to that,” and the ship’s systems were also “very effective in that adaptability.”

The Petersen learned lessons both in “how to stay at sea for a long time” and in how to defend against new tactics, Mahon said, and has passed on those lessons to other ships that are in the region now.

“Like any good Navy ship, you know, you’re ready for that next mission,” Mahon said. “It wasn’t what we expected to happen on deployment, but for the crew, you know, whether you’re in the north Arabian Sea or the South China Sea, you’re at sea, and so we do the operations that we’re directed to do.”

Clutching ti leaf lei as she waited on the pier with her two children, Alysha Nishikawa said she was worried at times during the deployment, but she tried to “throw out positive energy” to her husband and reassure him that they were OK so he could continue to do his job.

Petty Officer 1st Class Ryhean Tucker, who was one of the first sailors to reunite with his family as the recipient of the “first kiss,” said the deployment was “stressful” and challenging. His wife, Taylor Tucker, said it was also challenging for her, taking care of their two children and moving from Virginia to Hawaii.

“It was a big job, but we did it,” she said.

]]>

Hegseth orders cyber, intelligence agencies to prioritize election defense

David DiMolfetta — Mon, 28 Sep 2026 18:15:00 -0400

Defense Secretary Pete Hegseth directed U.S. Cyber Command and military intelligence agencies to prioritize countering foreign threats to the upcoming elections, ordering intelligence collection and coordination with the Department of Homeland Security.

The Sept. 22 memorandum was released publicly Monday and instructs the defense intelligence enterprise to gather and analyze information on foreign election threats. It separately directs Cyber Command to use its existing authorities and capabilities to counter potential cyberattacks by foreign actors targeting the elections.

“I am therefore directing the entire [Defense Intelligence Enterprise] to mobilize every authorized asset, capability, and partnership under your command to defend our election infrastructure from foreign malign influence,” Hegseth wrote.

The memo is addressed to the leaders of Cyber Command, the National Security Agency, the Defense Intelligence Agency and the National Geospatial-Intelligence Agency. It calls protecting elections a “no-fail mission,” but does not identify particular adversaries or operations, specify additional staffing or funding, or set implementation deadlines.

The directive notably comes amid a broader retreat from dedicated federal efforts to track foreign influence and disinformation. The second Trump administration has dismantled the FBI’s Foreign Influence Task Force, reorganized the intelligence community’s coordination of that work and reduced election security support at the Cybersecurity and Infrastructure Security Agency.

At the Office of the Director of National Intelligence, an overhaul shifted many responsibilities of the Foreign Malign Influence Center to other offices. ODNI has subsequently assigned two officials to coordinate election threat intelligence.

Foreign election threats can range from attacks on voting-related computer systems to campaigns intended to manipulate public opinion.

The NSA collects foreign signals intelligence, including intercepted communications, to understand adversaries’ plans and capabilities, while also helping protect sensitive U.S. systems. Cyber Command conducts military cyber operations, including missions to disrupt foreign hackers and the infrastructure they use.

The organizations have previously combined those capabilities through a joint Election Security Group. In a description of its work during the 2022 midterms, NSA explained that intelligence about an attack originating abroad could be shared with domestic agencies to help them defend against it, while Cyber Command could use offensive operations to disrupt the foreign attacker.

Hegseth’s memo does not specify whether the same organizational model will be used this year. It directs intelligence work to comply with applicable laws and policies and tells Cyber Command to operate under its existing authorities.

The directive also emphasizes cooperation with DHS as that agency’s civilian cyberdefense agency outlines how it will assist election officials following staffing and program reductions.

Two days after Hegseth signed the memo, CISA—housed within DHS—released an election security plan identifying its 10 regional directors as election security advisers and describing a free threat-sharing platform connecting election officials, state intelligence hubs and federal partners. That plan followed warnings from state officials that earlier cuts had weakened their access to federal security expertise.

The 2026 elections come as rapid advances in AI allow foreign influence operators to automate more of their work. Such capabilities could let adversaries run larger campaigns with fewer people, adding to the challenge of identifying coordinated manipulation ahead of the midterms.

]]>

Anthropic loses legal fight to shed DOD's designation as a 'supply-chain risk'

John Croxton — Fri, 25 Sep 2026 17:57:36 -0400

Anthropic will remain a Pentagon-designated supply-chain risk, thanks to federal judges who ruled that the Defense Department can prohibit its employees and contractors from using the AI company's products for DOD business.

The designation has been in force since March, when the department sought to alter its contract with Anthropic to replace prohibitions on using its tools for domestic mass surveillance and fully autonomous weapons with allowances for “all lawful use."

The department has used two statutory justifications for labeling Anthropic a supply-chain risk, a designation typically applied to firms suspected to be working for adversarial governments. Anthropic beat back one of the justifications in an August ruling in the Northern District of California, but did not prevail in a lawsuit heard by the D.C. Circuit Court of Appeals.

Friday's ruling was issued by Judges Gregory Katsas and Neomi Rao, both appointed during the first Trump administration, with a dissent by Judge Karen LeCraft Henderson, who was appointed by the first President Bush.

“This was not an unexpected outcome given the composition of the panel that heard the case” said Charlie Bullock, senior research fellow at the Institute for Law & AI think tank. “Historically, both Katsas and Rao have shown a great deal of deference to the Trump administration's assertions of executive authority on matters of national security. If Anthropic had drawn almost any other two judges from the D.C. Circuit for that panel they would have stood a good chance of winning, because I think their legal position is overwhelmingly strong.”

“I think Anthropic’s chances on appeal if they get to appeal either to the en banc D.C. Circuit or the Supreme Court are good. But they’re not guaranteed to be heard, because the appeals process is discretionary,” Bullock said.

In a statement to The Washington Sun, an Anthropic spokesperson said, “We respectfully disagree with the court’s decision. Another federal court has already held the government’s parallel designation unlawful.”

Anthropic added, “We remain confident in our position and are considering all options, including further review.”

Defense Undersecretary Emil Michael wrote in a statement on X, “The hammer of justice has smashed @AnthropicAI arguments. They are a supply-chain risk to the defense industrial base serving the @DeptofWar. Warfighters will sleep better knowing that no private company will insert their opinions in the chain of command. @SecWar was right!”

The ruling will likely keep the Pentagon and its other contractors reducing their use of Anthropic's products, such as its Claude tools. Overall, however, the company's revenue is growing about tenfold per year, and plans an IPO in November that some expect to value the company at a record $2 trillion.

Michael and Defense Secretary Pete Hegseth have been critical of Anthropic in public statements. In January, Hegseth stated in remarks at a SpaceX event, “Department of War AI will not be woke. It will work for us. We're building war-ready weapons and systems, not chatbots for an Ivy League faculty lounge.”

DOD issued an ultimatum on Feb. 24 demanding the company permit its AI to be used for all legal purposes by Feb. 27, which Anthropic refused. Hegseth announced his direction that DOD designate Anthropic a supply-chain risk Feb. 27, and it was formally announced on March 3.

]]>

Stolen FBI data reveals employees’ roles in intelligence and surveillance

David DiMolfetta — Wed, 23 Sep 2026 23:33:00 -0400

Data stolen in a major hacking group’s alleged intrusion into FBI systems is believed to contain personal information on hundreds of FBI intelligence analysts and other employees involved in clandestine intelligence-gathering and surveillance, according to two people familiar with the matter.

The analysts focus on myriad subject areas like Russia, China, Hezbollah, and cartel-related intelligence, said the people, who spoke on the condition of anonymity because the exposures are sensitive. The employees’ roles only offer a small picture of their duties, but may still help outsiders identify people working in sensitive parts of the bureau.

ShinyHunters claimed responsibility for the breach Monday, threatening to release what it described as two to three terabytes of FBI employee data unless the bureau retracted a public warning about its tactics within a week.

On Tuesday, the group sent Nextgov/FCW and other news outlets an apparent sample of that data containing roughly 5,000 entries listing employees’ names, home addresses, phone numbers and information about their spouses and siblings.

Multiple individuals also work on human intelligence-gathering, as well as roles involving electronic surveillance activities that make use of telecom interception techniques and other covert access mechanisms. Some employees work in the FBI’s Remote Operations Unit, which builds specialized tools to target computers and networks.

One person works in the bureau’s FISA Management Unit, which handles the processing of applications and renewals under the Foreign Intelligence Surveillance Act that governs surveillance and search standards used to collect foreign intelligence.

The FBI said it was aware of “a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information” and added that it is investigating the matter.

The agency said the cause of the breach was still undetermined. ShinyHunters previously said it exploited vulnerabilities in Amazon and Oracle services to access the bureau data. Neither company has returned a request for comment.

Reuters and 404 Media previously reported details regarding the intelligence roles and the ROU staff.

The language ShinyHunters wants removed appears in a May 15 FBI public service announcement that describes practices the hacking group contests. The group has built a global reputation for various hacking achievements. In May, it claimed responsibility for accessing Canvas, the popular education tech platform used by thousands of U.S. institutions.

The direct claim of an FBI breach is “an unusually provocative move” and should be taken seriously, said Etay Maor, the vice president of threat intelligence at Cato Networks.

Exposure of sensitive bureau staffing data could pose profound counterintelligence risks. For employees who do not publicly identify themselves as working for the FBI, the exposure could reveal both their jobs and how to reach them outside secure work environments. Linking that information to home addresses and relatives’ details could make it easier for nation-state groups and cyber criminals to target employees and their families with harassment, scams or threats.

The breach would be “troubling news” for both FBI employees and applicants, said Doc McConnell, a former cyber policy official at the White House and the Cybersecurity and Infrastructure Security Agency.

McConnell, who now heads policy and compliance at Finite State, compared the incident to the OPM hack a decade ago.

“The breach of OPM’s personnel records in 2015 resulted in a decade of credit monitoring for millions of affected individuals, and the full counterintelligence impact will likely never be known. This breach appears to contain similar data, creating potential security concerns for the victims if it is made publicly available,” he said.

The bureau will likely work more assertively to crack down on ShinyHunters. When any group directly targets the agency, “they should expect that the FBI is going to marshal additional resources to bring them more quickly to justice,” said Cynthia Kaiser, the SVP of Halcyon’s Ransomware Research Center and former deputy director of the FBI’s Cyber Division.

The incident follows other cyberattacks involving the bureau and its leadership this year. In March, pro-Iran hacking group Handala published material from FBI Director Kash Patel’s personal email account, which the bureau said contained historical information unrelated to government business. Separately, a suspected China-linked intrusion into an FBI system exposed surveillance targets’ phone numbers.

]]>

Trump's FBI shut down investigation into defense contractor's alleged bribes

Kirsten Berg, Molly Redden, Avi Asher-Schapiro, and William Turton, ProPublica — Tue, 22 Sep 2026 13:38:39 -0400

In the final weeks of 2019, a top fundraiser for Sen. Susan Collins walked into a perilous meeting at a Corner Bakery in Washington, D.C.

For the first time in her two-decade Senate career, the Republican lawmaker from Maine was in danger of losing her seat. President Donald Trump’s dismal approval ratings were dragging her down in the polls, and she was falling behind her likely 2020 Democratic challenger in fundraising.

Scott Reed, head of the Collins super PAC, was on a mission to close that gap. Reed was meeting that day with three executives from a Hawaiian defense contractor, Navatek. A year earlier, Collins had helped their company land a multimillion-dollar Navy research contract in Maine. Now, seated at a coffee shop not far from the U.S. Capitol, Reed asked them for a $500,000 donation.

Government contractors are banned from making political contributions. More consequentially, for the company to offer donations to Collins in exchange for an official action, or for Collins to accept, would constitute criminal bribery.

But the company did have such a proposal: Navatek was hungry for more government contracts in Maine. If they cut a big check, the CEO told Reed, Navatek wanted Collins to guarantee tens of millions of dollars in additional federal funding.

To skirt campaign finance laws and conceal the source of the funds, Navatek planned to funnel the donation through a shell company. The CEO wanted assurance that Collins would know where the money came from. Reed confirmed that she would, the executive said — and that Navatek would get its government contracts.

After the Corner Bakery meeting, Navatek’s CEO, Martin Kao, sent an initial $150,000 to the Collins super PAC using the shell company. Two months later, he told Navatek executives that Collins committed to getting the company $32 million in naval contracts, according to an internal company email reviewed by ProPublica.

Three years later, Kao holed up in a conference room to recount the Corner Bakery meeting to a group of four FBI agents and federal prosecutors. The FBI had seen through his shell company ruse, and in 2022 a grand jury indicted him for making illegal campaign contributions. No one working for Collins was charged.

Facing years in prison, Kao hoped to do less time by revealing the entire scheme.

What he told them has never before become public. The Corner Bakery meeting, he asserted, was just one episode in a sprawling pay-to-play operation that embroiled some of the most powerful figures in Congress.

Over three days at the U.S. attorney’s office in Honolulu, Kao laid out in devastating detail how his operation worked. He gave agents a 50-page document naming dozens of lobbyists, congressional staffers and members of Congress who he said helped him trade cash for contracts. Kao and his close associates had donated nearly $900,000 to dozens of politicians, allowing Navatek to establish operations in half a dozen states with over $40 million a year in government funding.

Most damningly, Kao told FBI agents and prosecutors, the company’s work for the government was of no real value. Navatek’s research under his stewardship never resulted in products the military wanted to buy, ProPublica found.

Kao’s tell-all interviews with the FBI lasted into late 2024. His confessions opened up an entirely new phase of the investigation. Agents sifted through hundreds of thousands of records seized during Kao’s arrest and found that many were consistent with his account of widespread influence peddling.

Kao had credibility issues. He was now a felon trying to avoid a lengthy prison sentence. And there were other challenges. Building a corruption case against elected officials requires extraordinary proof of a quid pro quo arrangement, in part because the Supreme Court has narrowed what counts as bribery.

Even so, by the end of 2024, the agents had enough evidence to pursue a sweeping bribery probe that could ensnare top lawmakers of both political parties. They asked their supervisors to approve a new investigation and contemplated using undercover operatives to gather more evidence. Although their effort was in its early stages, and it was unclear where it would lead, FBI agents asked Kao extensive questions about his dealings with Collins and her office.

Then Trump returned to the White House. Consumed by a campaign of vengeance, he stacked the Department of Justice with his personal lawyers and demanded a purge of anyone who had ever investigated him.

The specialized FBI and DOJ teams handling public corruption investigations, some of which were involved in Trump-related cases, were eviscerated. One of the agents who had taken Kao’s confession was pushed out as retribution for her role in investigating Trump’s attempt to overturn the 2020 election. Dozens of agents and prosecutors quit amid the department’s destruction, including the career attorney assigned to Kao’s case.

Trump’s Justice Department no longer takes on public corruption in any meaningful fashion, former officials said. The investigation sparked by Kao’s revelations is dead. And the government is no longer talking to an informant who had offered a road map to corruption in Congress.

The White House referred ProPublica to the FBI.

FBI spokesperson Ben Williamson said the agency had investigated claims against Collins years ago “and ultimately found nothing implicating Senator Collins or Senator Collins’ campaign. Any suggestion otherwise is totally false.” Williamson said the Trump administration has removed agents only “if they have been found to have acted unethically, undermined the mission, or engaged in weaponization of law enforcement.”

Williamson did not respond to questions about the new investigation launched in 2024 based on Kao’s previously unreported cooperation with the FBI.

ProPublica is revealing the existence of the case for the first time. We reviewed a trove of evidence gathered by the FBI and thousands of pages of legal records, and interviewed dozens of people familiar with Navatek, its Washington operations, and the FBI inquiry to conduct our own investigation. We independently corroborated much of Kao’s account. Whether or not Kao’s dealings with politicians amount to criminal bribery, the Trump Justice Department has little interest in finding out, and his sheer success reveals how easily influence is purchased in Washington today. This is the first in a series of stories drawn from our reporting.

Of all the politicians Navatek courted under Kao’s leadership, Collins was its most important patron. The senator’s office steered government contracts worth millions toward the company while her campaign was pumping Kao and his network for donations, according to emails seen by ProPublica. Sometimes they cut checks within 24 hours of the annual defense spending bill, which funds military contracts, clearing a key Senate hurdle.

Collins’ office did not specifically address questions about the Corner Bakery meeting, the senator’s relationship with Kao and the millions she helped appropriate for Navatek.

Annie Clark, Collins’ deputy chief of staff, told ProPublica in an email that Collins’ office “vigorously” denies allegations of bribery and pay-for-play made by Kao, calling his claims “outlandish.” Collins’ campaign was not part of the discussions between Kao and the super PAC, and her office “fully cooperated” with the FBI investigation, Clark said.

“The fact that the FBI and Biden-led Department of Justice thoroughly examined the Navatek matter demonstrates this,” Clark wrote. “These issues were resolved in 2021 and concluded when the Collins campaign disgorged the illegal contributions that Martin Kao had made without our knowledge.”

Collins is once again fighting to keep her seat, in a race that could determine control of the Senate. On the campaign trail, she spotlights the funding she directs to Maine while leading the appropriations committee, which she calls “the most powerful committee in the Senate.”

She demonstrated that power with Navatek. After the budgets became law, Collins’ office pushed the Navy to award specific contracts to Navatek, emails seen by ProPublica show, even though awards are supposed to be competitive.

“I spoke with Sen. Collins office regarding the $8M,” a naval official wrote in an email on Feb. 6, 2019. “The interested company is Navatek.”

In a meeting with Collins and two campaign officials, Kao said, the officials told him the senator expected his ongoing support. Collins told him: “You’ve seen me deliver,” Kao said.

Reed knew Kao was behind the $150,000 anonymous donation, emails showed, because Kao told Reed he planned to donate through a shell company. “Very smart,” Reed replied in an email viewed by ProPublica.

Reed did not respond to detailed questions about the Corner Bakery meeting, the $150,000 donation and Kao’s allegations. “I understand Martin Kao is now sitting in federal prison,” Reed wrote in a brief email. “I never had any communications with Senator Collins [or] her staff about Martin Kao and/or Navatek.”

But an email seen by ProPublica suggests that someone must have relayed the news of Kao’s donation to Collins, just like Reed promised to do in Kao’s recounting of the Corner Bakery meeting.

Seven days after the super PAC cashed the check from Kao’s shell company, one of Reed’s subordinates emailed a Navatek lobbyist asking for Kao’s phone number: “Senator Collins would like to call Martin to thank him.”

The Navatek Method

Before Kao’s doomed reign as CEO, Navatek was a sleepy Hawaiian engineering company with a few dozen employees. It was founded in 1978 by Steven Loui, a talented engineer and scion of a powerful Hawaiian shipping family. Navatek was not a profit center but a vehicle for Loui’s passion projects, like an experimental catamaran for navigating Hawaii’s choppy waters.

The company benefited from the largesse of the legendary Hawaii Sen. Daniel Inouye, multiple former Navatek executives and employees said, whose family had been close to the Loui family for generations. Inouye was a master of earmarks, a practice that allowed lawmakers to insert funding for specific companies by name in the federal budget. The self-styled “King of Pork” steered hundreds of millions in federal dollars to Hawaii. Former Navatek employees say he was affectionately referred to as “Uncle Dan.” “Before Inouye took an interest, Congress didn’t even know our companies existed,” a longtime Loui lieutenant wrote in a 1998 op-ed.

In response to ProPublica questions, Loui said that money appropriated by Inouye made up “a minority” of Navatek’s revenue.

Inouye’s death in 2012 made the company’s future uncertain. Not only was Navatek’s direct line to Capitol Hill gone, but Congress was doing away with the abuse-riddled earmark process. Now companies would nominally have to compete on the merits for government contracts.

Kao joined Navatek in 2008 as its chief financial officer. Loui charged him with replacing Navatek’s rainmaker and eventually named Kao CEO. He sold Kao the company in return for a share of the profits.

Kao was an unusual figure among the company’s low-key naval engineers and boat aficionados. He seemed to be aping a Wall Street tycoon, telling employees they could either be “a beast or a bitch,” a former executive said. He drove to work in a Ferrari and abruptly fired subordinates who displeased him — one time, in the middle of the night. “He had very little interest in the technology,” one former employee recalled. “Martin was only interested in dollar signs.”

Kao also exaggerated and lied. He told different people he had stepbrothers whose parents died in a fishing accident or an avalanche, a former employee recalled. He lied to Loui about having law degrees from both the University of California, Los Angeles and New York University. He once told a lobbyist who raised quarter horses that he owned a herd of polo ponies, just to one-up him.

Despite his erratic behavior, former employees agree Kao hit upon an effective way to replace the lost earmarks. If the company could not rely on a benefactor like Inouye, it would develop a stable of them.

Navatek targeted the powerful members who sat on the House and Senate appropriations committees. These members could no longer earmark money for specific military contractors. But they retained the power to budget millions of dollars for equipment or bespoke research and development. Because Pentagon budgets run thousands of pages and are largely prepared in secret, it is easy for appropriators to add a line item intended for a contractor like Navatek without leaving any fingerprints.

Soon, Kao had refined a playbook. Navatek would concoct a research project in partnership with a university in a member’s district or home state, and Kao would make a large initial campaign donation. Working with a team of pricey, well-connected lobbyists, Navatek would get meetings on Capitol Hill to pitch the research to congressional staff. Navatek kept spreadsheets, reviewed by ProPublica, that listed members of Congress as the “specialty” of certain lobbyists.

Separately, Kao later told the FBI, there would be a meeting of just the key players. One engineer, who traveled with Kao to D.C. to explain the technical side of a project, recalled being sent out of the room once the subject of money came up. Sometimes in these smaller meetings, members of Congress directly asked Kao for donations, he told the FBI. In other cases, he said, Navatek’s lobbyists would relay a request from an intermediary for a specific dollar amount.

Kao told the FBI that the lawmakers, lobbyists and Navatek brass understood these donations were bribes and that the payments were essential to the entire scheme. Kao believed he was buying Navatek’s way into the annual defense budget, not winning over members with innovative engineering proposals.

“I’m not red or blue, I’m green,” he would tell congressional staffers, a former Navatek employee recalled.

While a deal was being struck, Navatek and congressional staffers worked closely on the legislative process. Every year, Congress prefaces the defense budget with massive reports describing the purpose of inscrutable line items. Staffers would include a project description so specific that Navatek would be the only logical pick.

Often, Navatek composed language that ended up, word for word, in Senate funding requests, former employees said. In 2019, for example, Navatek’s priorities were tucked into page 185 of the 307-page report released by the Senate Appropriations Committee. The committee set aside $21.5 million for “hybrid composite structures research for enhanced mobility,” “electric propulsion for military craft and advanced planing hulls” and a “test bed for autonomous ship systems.” Although Navatek’s name does not appear on the page, these were all projects the company requested, according to internal documents and interviews with former employees.

Once the budget passed, lawmakers’ staff leaned on Navy officials to award Navatek the money. Former contracting officers told ProPublica they felt pressure to go along because money from those contracts funded their office — and because members of Congress had confronted dissenting naval officials in the past. “There’s only so many battles you can fight,” one said. So Congress sometimes got its way even when Navatek’s projects made little sense.

Inside Navatek, employees referred to this strategy as “the method.” And it enabled the company to string together tens of millions of dollars in contracts. The result was the same as getting earmarks: a reliable, growing revenue stream bankrolled by U.S. taxpayers.

“It was a simple enough play. Let’s find the small states that have complementary universities … [and] let’s get access to their senators,” Eric Schiff, a former Navatek executive, told ProPublica. “I’ve met Susan Collins. You can get access to Susan Collins. Once we got the first things working with Maine, then we said, ‘Well, let’s keep reaching.’ And so we did.”

In a statement to ProPublica, Navatek founder Loui said Kao’s “unethical and illegal method of winning contracts” was a departure from how he operated the company prior to Kao’s ownership.

Kao boosted Navatek’s annual revenue from $10 million around the time Loui sold him the company to almost $40 million when he was arrested in 2020. In the second half of 2019 alone, Navatek paid a roster of five lobbying shops more than $500,000.

Even Navatek’s executives were surprised at how far their money went in D.C. “It was eye-opening for me, frankly. ‘Oh my God, all of it is for sale. It’s all for sale,’” Schiff said.

The key players in Kao’s pay-to-play deals went to great lengths to meet in person and leave no trace of an actual quid pro quo, he told agents. “That is why I literally had to fly to D.C. almost every week,” Kao later told the FBI. “Sometimes for a 15-minute meeting.”

But the FBI compiled emails, which ProPublica reviewed, that were suggestive of illegal bargains. Navatek executives and lobbyists spoke openly as if they were buying lawmakers’ assistance. In one back-and-forth, a lobbyist and a company executive described another senator as “fundamentally transactional” and having “a reputation as a pay-to-play office.”

In another message, Andy Winer, who former executives said was Navatek’s chief strategist, reminded Kao to budget money for political contributions based on how much the company wanted in congressional funding the following year.

Winer was his guide to the political underbelly, Kao said. A consummate insider, Winer had parlayed six years as chief of staff to Democratic Sen. Brian Schatz of Hawaii into a lucrative lobbying career with a firm called Strategies 360. One of Winer’s former colleagues compared him to the slick lobbyist on the Netflix show “House of Cards” who toggles between the political and corporate worlds.

In another email exchange scrutinized by the FBI, Kao asked Winer about making a $5,600 donation to nudge along a senator who seemed keen to work with Navatek: “Would that ‘help?’”

Winer, who had already donated himself, replied, “With my contribution, I think it sends the right message.” He suggested Kao split up his donation to be “less conspicuous.”

The method didn’t always work. Once, Kao complained that a senator had reneged on a deal and he ought to get his donations back.

“You should not feel aggrieved nor should you ever put that in writing,” Todd Webster, another lobbyist Navatek hired, replied. Webster did not respond to detailed questions.

Winer said he stopped working with Navatek following Kao’s arrest. “The political contributions I discussed with Kao were understood by me to be lawful political contributions. I never participated in, witnessed, or had knowledge of any illegal political contribution, bribe, or agreement to exchange a political contribution for an appropriation, contract, or other official action,” Winer said in an email to ProPublica. “I never advised Kao to make a contribution in exchange for official action.”

Strategies 360 has new ownership that did not oversee Winer while he represented Navatek, its CEO, John Oceguera, said.

Navatek employees began to notice members of Congress visiting their East Coast offices. “You would be like, ‘Oh, there’s this senator walking around,’ and we would get a picture with them,” one engineer recalled.

While some projects involved potentially meaningful research, Navatek’s bread and butter was R&D that went nowhere. As a slideshow prepared by an executive explained, “We thrive in the valley of death,” the term for the bureaucratic gap where research languishes without being developed into a product. The slideshow noted that none of the technology had ever actually been deployed.

The Office of Naval Research did not respond to a request for comment.

In Maine, Navatek was studying ways to modify small boats to reduce the “slamming” impact felt by passengers at high speeds. With the help of the University of Maine’s giant 3D printer, Navatek made a prototype and unveiled it at a press conference where a Guinness World Records representative declared it the world’s largest 3D-printed boat. But Navatek executives knew the Navy had no plans to use the new design, former employees said.

“[The work] got rolled into a few PowerPoint slides and a white paper, and that was the deliverable,” recalled one who worked on the project. “The boats weren’t delivered to the Navy — the Navy didn’t even want them.”

Kao to Collins: “Here to Help”

The first time Kao came face-to-face with Collins, in 2018, he told the FBI, he had to pay for the privilege.

Collins would not meet unless he agreed to donate to her campaign, he said. While it is not illegal for politicians to exchange face time for contributions — in this case, just a few thousand dollars — it was not the last time Collins would seek Kao’s support.

Navatek had been eager to expand beyond Hawaii, and Maine was a perfect beachhead — a small, coastal state hungry for high-tech jobs that happened to be represented by a senior member of the Senate Appropriations Committee. Collins, more than most appropriators, likes to trumpet the dollars she brings home.

To work with Collins, Navatek hired a lobbyist, Glen Mandigo, who also lobbied for the University of Maine and was tight with her office. Mandigo asked how much Navatek wanted in funding and how much Kao was willing to support Collins, Kao told the FBI. The University of Maine did not reply to a request for comment.

In that first meeting with Collins and her staff, Kao pitched an $8 million boat hull research project for Navatek and the university. Collins seemed supportive. Not long after, Mandigo called Kao and said Collins wanted him to bundle tens of thousands of dollars for her reelection, suggesting Navatek throw a fundraiser, Kao said.

In an email to ProPublica, Mandigo denied taking part in a pay-to-play arrangement.

“I did not advise Navatek officials, nor would I advise any client, that support from Sen. Collins was contingent on campaign donations,” Mandigo wrote. He said that in his 25 years of working with Collins and the Maine delegation, “I never saw or heard of such behavior from the Senator or her staff.” Clark, Collins’ deputy chief of staff, told ProPublica it was “wholly inaccurate” to say Mandigo was close to their office.

FBI agents had collected voluminous corporate records and email correspondence between Navatek and Collins’ inner circle. Much of that evidence aligned with the story they were now getting directly from Kao.

The FBI had spotted his out-of-the-blue donations in the summer of 2018, just before Collins included $8 million for Navatek’s proposal in the defense budget. Emails showed her staff made it clear to the Navy that it should send the money to Navatek. FBI agents also had evidence of Kao and Mandigo planning a fundraiser starting in April 2019. Their emails — with her scheduler and her campaign’s finance director — freely mixed talk of Navatek’s Collins-backed contract with plans to raise money for her.

The principals settled on hosting Collins for a publicity event at Navatek’s Maine headquarters in August 2019, where she posed for pictures with Kao and a model of the company’s experimental boat. Behind the scenes, the FBI saw in emails and company records, Kao orchestrated over $40,000 in donations from extended family in advance of the event. To avoid the legal cap on individual campaign contributions, the emails show, he told Collins’ team to reallocate his excess contributions to his father — which an agent highlighted and noted is against election law in a presentation to prosecutors — and sent them his father’s full name and address.

“This is perfect,” Amy Abbott, the reelection campaign finance director, emailed Kao after discussing his father’s contribution. “We are so grateful for ALL the Kao support!”

Before the event, Kao said, Collins, Abbott and another staffer met with him in private. One of the staffers told Kao the campaign expected more donations. It was in this meeting that Collins said, “You’ve seen me deliver,” he told the FBI.

Less than one month after the event, the Senate released a draft of the defense budget containing $21.5 million for Navatek’s pet projects in Maine. Kao emailed a Collins campaign fundraiser — who would in theory have nothing to do with a government contract — four days later, saying, “Thanks again for all the support from Sen Collins.”

“I’ve been involved in many tight races in the past and understand last minute ‘needs’ come up,” he continued. “We are here to help anyway we can … financially or whatever.”

Kao’s desire to donate even more money led to the fateful Corner Bakery meeting with the head of the Collins super PAC, called the 1820 PAC, Kao told the FBI. Unlike Collins’ campaign, which could accept only $5,600 per election from individuals, the super PAC could accept unlimited contributions.

The super PAC emailed Kao a memo before the meeting stressing the need to raise money with “urgency.” At the meeting, Kao and Reed, the super PAC’s chair, hammered out a deal for a six-figure donation, Kao told the FBI. Over email, Kao informed Reed of his shell company scheme, saying he had cleared it with his lawyer. “They are super vague and very difficult to get any background info on,” Kao reassured him. “Thanks for doing this,” Reed replied.

Emails

Here are quotes from emails between Martin Kao and Scott Reed, discussing contributions to the Susan Collins Super PAC, 1820 PAC:

“Hi Scott: Had a chance to discuss 1820 with my CFO and attorney last night. They are suggesting setting up a separate new LLC to make the donations. Name of new LLC: Society of Young Women Scientists and Engineers. In my personal real estate investments, we often use LLCs that can be set up to “facilitate” transactions. They are super vague and very difficult to get any background info on. Totally legal and typically used in real estate transactions to conceal the identity of buyer/seller. Wanted to get your thoughts/concerns.”—email from Martin Kao to Scott Reed, Nov. 22, 2019

“Very smart and glad your counsel understands. Thanks for doing this.”—email from Scott Reed to Martin Kao, Nov. 22, 2019

“Great! We will proceed on getting this set up ASAP. Have a nice weekend.”—email from Martin Kao to Scott Reed, Nov. 22, 2019

The FBI spoke to the other Navatek executives at Corner Bakery, who confirmed the meeting took place. One of them, David Kring, the company’s top scientist, told ProPublica he had no memory of what was discussed.

The other, Duke Hartman, told an FBI agent it was just “a get-to-know-you meeting” with the chair of the super PAC and they did not discuss the “particulars of a donation.” Agents, records show, came to believe Hartman was lying about his role in Kao’s pay-to-play operation and would name him as a formal subject of a future investigation. Hartman was not charged. He did not respond to a detailed request for comment.

A few weeks after the $150,000 check to the Collins super PAC cleared, in February 2020, Kao and his team met with Collins’ office and secured a new round of funding.

“We were very warmly received,” Kao reported to his colleagues in an email obtained by the FBI. “Excellent meeting. Total of $32M will be supported.” Records show the Senate allocated at least $10 million that year based on Navatek’s proposals.

Navatek’s ambitions peaked in mid-2020. As the company waited to see if Collins would survive her reelection campaign, executives prepared to ask their champion on the appropriations committee for even more funding the following spring, internal documents show.

Other documents from that time show the company was courting senators from seven additional states and gunning for more than $200 million in new appropriations. Navatek expected to have offices in more than a dozen states by the end of the following year, including a new 15,000-square-foot facility in the Portland, Maine, harbor.

Kao, meanwhile, closed on a $4.5 million beachside home in an exclusive Honolulu neighborhood; the backyard pool had a waterfall feature. He renamed the company Martin Defense Group after himself, joking that it would simplify his future takeover of Lockheed Martin.

“It was working well, and it would have continued to work well,” said Schiff, the former executive. “Martin got greedy. Just got damn greedy.”

Downfall, Cover-up

In early 2020, the Campaign Legal Center, a nonprofit good government group, noticed something strange in the public filings for the Collins super PAC. The PAC had received a $150,000 donation from a newly created LLC with a typo in its name: the Society of Young Women Scientist and Engineers, with no S at the end of “Scientist.”

This was the $150,000 Kao donated after the Corner Bakery meeting. The money had come from Navatek’s account, not Kao’s, violating a ban on government contractors making donations.

The center suspected the society was not a real group but a pass-through to hide the identity of a major political donor. It filed a complaint with the Federal Election Commission. It took only a few days for a Hawaii journalist to discover Kao’s wife’s name on the society’s paperwork, linking the shell company to Navatek.

Inside Navatek, Kao shifted into damage control mode. He spoke to Reed and the super PAC’s lawyer, Cleta Mitchell, and began to hatch a cover-up. In an email released in civil litigation, Mitchell suggested the society make charitable donations — preferably in Maine — which would make it seem like a legitimate nonprofit. “I want to be sure that the LLC proceeds with the ideas we discussed — giving scholarships and recognition to women in engineering, etc.,” wrote Mitchell. “That would help both of us, I think.”

Mitchell added, “We should develop a plan and timetable, so there are some scholarships given over the next several months, and particularly, perhaps in Maine, where the bad press was.”

Mitchell, who later played a major role in Trump’s attempts to overturn the results of the 2020 election, did not respond to requests for comment.

Kao and his team settled on donating scholarships to women in STEM. They offered between $5,000 and $25,000 apiece to state universities where they were angling to win government contracts — that way, the cover-up would benefit them politically, too.

But Navatek’s and Kao’s problems were just beginning. Undeterred by scrutiny from the FEC, Kao defrauded the COVID-era Paycheck Protection Program newly passed by Congress. He inflated Navatek’s payroll to amass loans of $13 million, according to a federal indictment. The Navatek founder, Loui, had long since soured on his chosen successor. This was the final straw. He reported Kao to federal authorities.

“This is not how Navatek behaved or conducted business before I sold the company to Martin Kao,” Loui wrote to ProPublica. He said Navatek was successful before Kao’s ownership and had many sources of government funding. After Kao’s arrest, he added, the company fully cooperated with law enforcement.

Loui has since regained control of the company and renamed it PacMar. He is dedicated to restoring its reputation and ability to execute government contracts, he continued. Loui said he fired employees hired during Kao’s tenure who were “not capable of performing quality, professional engineering and science tasks.”

“The company received no Collins-supported funding after Martin Kao’s arrest, nor should it,” Loui added. “What Martin Kao and his cabal did was wrong.”

On Sept. 30, 2020, law enforcement raided Navatek’s Honolulu offices and arrested Kao for fraud. Federal agents in windbreakers seized his laptop and ordered the company’s IT staff to copy the company’s internal servers.

Navatek’s public flameout attracted the attention of Michelle Ball and Kevin Gounaud, two experienced agents in the FBI’s elite anti-corruption unit. Gounaud was a 20-year FBI veteran who had worked on elaborate undercover operations. Ball had made a name for herself taking on politically sensitive cases. In 2018, she led the investigation into Maria Butina, the Russian agent convicted of infiltratingthe National Rifle Association in an attempt to influence the Trump campaign.

The agents began digging through thousands of records for details of Navatek’s lobbying operation, donation strategy and ties to politicians.

They zeroed in on Kao’s relationship with Collins. In a 60-slide presentation agents prepared for prosecutors, they highlighted contributions that Kao and his wife made to the senator in 2018, right before Collins placed the $8 million in research funding into the federal budget. Kao had also given Navatek money to various relatives to donate to Collins in 2019, sending her around $33,000 through these illegal straw donors, the indictment said. Kao’s wife and father did not reply to requests for comment.

The government charged Kao in two separate cases: one for defrauding the loan program and another for his campaign finance crimes. His love of talking like a wheeler-dealer — including over email — was a gift to investigators. In one email, he all but admitted the scholarships to young women were a diversion. “Whatever… just a pack of bitches getting free $,” he wrote.

In the face of overwhelming evidence, Kao pleaded guilty in both cases in the fall of 2022. Navatek by then was under court-ordered new management. Awaiting sentencing, Kao worked as a line cook at a Cheesecake Factory.

He began meeting with the same FBI agents and prosecutors who brought him down. For the agents, he was a rare witness: a contractor with deep ties to elected officials saying he would speak candidly about how Washington works.

Kao faced nearly a decade in prison. “My world and life imploded,” he would later recall in a letter to the Hawaii U.S. District Court. “I was fooled and foolish enough to believe that the power elected officials wielded, and [were] actively willing to sell to anyone wealthy enough to pay, was….‘smart business.’”

Over the next two years, Kao sat with agents for at least three dayslong interviews. He told them that politicians, Collins in particular, had been willing participants in his scheme. “It takes two to tangle,” he told them.

Taxpayers funded Navatek’s entire political operation, Kao said. “Most companies of our size do not have the resources to endlessly hire expensive lobbyists and make political donations,” he told the FBI. Navatek solved this by using money from government contracts to hire lobbyists and make campaign contributions, according to interviews, court testimony and internal company records. Diverting money from contracts for lobbying and political donations can be illegal.

For their final meeting, in September 2024, Kao handed the FBI the 50-page document detailing Navatek’s dealings with more than a dozen members of Congress and their staff. It was not only a confession but a road map, with the email addresses and phone numbers of people Kao thought agents ought to subpoena.

Last year, Kao was sentenced to 87 months in prison. The judge in his case offered no leniency based on his cooperation with the FBI. Loui is battling Kao in court to recover the millions he contends Kao stole from the company.

Both Scott Reed and Amy Abbott remain in Collins’ inner circle. Abbott is the finance director for her 2026 reelection effort, and Reed again chairs the main Collins super PAC. Abbott, who is married to Collins’ campaign manager, referred questions to the senator’s communications staff. Clark told ProPublica that Abbott and other campaign staff were interviewed by the FBI and that the campaign was never a target of the investigation.

Earlier this year, Kao agreed to meet a ProPublica reporter at the Federal Prison Camp in Yankton, South Dakota, where he is incarcerated. But on two occasions when guards summoned Kao over the intercom, he refused to enter the visitation room. Over email, he said he was no longer willing to meet, citing the ongoing litigation. He declined through his lawyer to respond to detailed questions.

By late 2024, Ball and Gounaud, the FBI agents, had come to believe there was enough evidence to warrant a broader investigation into bribery of members of Congress, according to a memo seen by ProPublica.

Before they could embark on their new mission, however, they became casualties of Trump’s retribution campaign.

Ball and Gounaud worked for the FBI’s elite anti-corruption unit known as CR-15, which specialized in investigating misconduct by elected officials. When Trump retook power, his new FBI director, Kash Patel, purged the unit agent by agent.

Ball was targeted for her work on the special counsel investigation of Trump’s failed bid to overturn the 2020 election. She was fired in October 2025 in a one-page letter stating she had “weaponized” the Justice Department. She is challenging her firing in a lawsuit. Gounaud was pushed out in early 2026. Both agents declined to comment through their attorney.

Trump also targeted the Justice Department attorneys who worked with CR-15. The team, known as the Public Integrity Section, collapsed spectacularly in February 2025 after staff were ordered to drop a case against New York City Mayor Eric Adams, a Trump ally. The unit’s leadership quit en masse. Trump appointees ordered the remaining prosecutors to halt new corruption cases, just months after Kao made his detailed confession.

Before Ball was fired, however, she managed to take a key step forward.

Based on all the evidence, she persuaded her supervisors to approve a new investigation. It centered on South Carolina, one of the states Navatek eyed for a rapid expansion. The FBI had questions about a steak dinner Kao shared with Sen. Lindsey Graham.

]]>