On August 25, CIA Director John Ratcliffe landed in Moscow. He met Russian officials, warned them against attacking NATO, raised Moscow’s support for Iran, and flew home. Allies and Kyiv were briefed before and after. It was the first trip of its kind since the former CIA Director William Burns made the same flight in November 2021, fifteen weeks before Russia crossed into Ukraine. As one former CIA operations officer put it, the fact that a director gets on a plane at all suggests the threat behind the trip was judged credible.

The warning had gone public three weeks earlier. US intelligence assessed that Putin could order a limited attack on a NATO member, most likely against the Baltics or Poland, at some point between this autumn and 2029. The assessed purpose is to test Article 5’s, and to fragment the alliance by proving it lacks a response.

The location for that scenario is Sweden’s front yard. Gotland sits in the middle of the Baltic Sea. Sweden’s air and naval reach covers the sea lines that would carry reinforcements to the Baltic states in the first week of a crisis, and Swedish territory is key for air superiority.

In 2022, Sweden’s intelligence failures were Sweden’s. The country was outside NATO, and a wrong Swedish assessment was not changed after American influence. But Sweden joined NATO in March 2024. Swedish capability will now feed an alliance and Swedish blind spots will become an alliance wide liability.

Sweden is rebuilding its intelligence architecture directly into this warning. A new civilian foreign intelligence service, Sveriges utrikesunderrattelsetjanst (UND), opens January 1, 2027.

Not the First Warning to Go Unheeded

The winter of 2021 into 2022 was not a case of intelligence that wasn’t shared in time. In fact, Washington and London put detailed intelligence assessments on the table publicly, repeatedly, and with a specificity that made professionals uncomfortable.

The influence operation was also conducted privately. Burns flew to Moscow in November 2021 to deliver warnings to the Kremlin, then made repeated trips to Kyiv and allied capitals.

These efforts unfortunately were partly in vain. The French and German services judged a full invasion too irrational and too costly for Putin to attempt. Several capitals read the American warnings through the memory of Iraq weapons of mass destruction and discounted them accordingly. The gap between what US intelligence believed and what European governments were willing to act on became one of the more consequential intelligence failures of the post-Cold War era. It was not a failure of collection; it was a failure of influence.

The analytic error underneath this failure is known as mirror-imaging; the assumption that your adversary weighs cost the same way that you do. European intelligence services were good at counting tanks, tracking movement and mapping order of battle. They were far less equipped to model what was happening inside the Kremlin, and when they tried, they substituted their own arithmetic for Putin’s.

Sweden’s record is part of that story. In the month before the attack, MUST assessed that a major assault was unlikely. Foreign Minister Add Linde questioned American intelligence directly to Secretary of State Anthony Blinken, leaning on her own service’s skepticism.

FOI, the Swedish civilian defense research agency, did not forecast a full-scale war either, but its Russia and Eurasia analysts raised the alarm publicly and privately. But the warnings sat outside MUST’s military remit and had no route into the warning chain.

Wilhelm Agrell, professor of intelligence analysis, called MUST’s miss a textbook error: analysts reasoned that invasion was unlikely because the consequences would be too severe. That was an assessment of what a rational Swedish planner would do in Putin’s position, not of Putin himself.

Why Military Intelligence Could Not Have Gotten this Right

The standard account of Russian deception before February 2022 is that Moscow hid its intentions from the West by dressing the buildup as an exercise. That is true and it is the less interesting half.

The more consequential fact is that Moscow hid its intentions from its own army. Captured Russian soldiers told interviewers they believed they were on a routine exercise until hours before they crossed the border. Their officers reportedly withheld the truth because they doubted the men would fight if they knew. The deception was not aimed outward alone, but at the force that was executing Putin’s orders.

The same held on the other side. The former commander of Ukraine’s Joint Forces has said he received no official written warning on the eve of the invasion and acted on an informal tip.

A military intelligence service collects against a military. It reads order of battle, logistics, movement, readiness, signals traffic, and where it can, human sources inside the structure. Every one of those disciplines was pointed at Russian forces in the winter of 2021, and every one of them was working.

They were also, on the question that mattered, reporting accurately. The units were postured for an exercise because the units believed they were on an exercise. The logistics looked thin for an invasion because the supply staff had not been told they were invading. A colonel asked in early February what his regiment was doing would have given an honest answer, and the honest answer was wrong.

The buildup was visible; but what was not visible was the decision. Putin realized his opponents intelligence weakness, and made the decision in a room that his wider military had no access to. Thus, collection against an army cannot retrieve a judgment that the army has not been told.

MUST did not miss the invasion because its analysts were incompetent or because collection was thin. It missed because it was asked a political question and had been built, staffed, tasked, and funded to answer a military one. Working harder inside that structure would have produced more detail about an exercise.

A design problem does not yield to effort. It yields to design. If intent lives in the politics of a regime rather than in its order of battle, then somebody has to be built to read the politics, and that somebody cannot report up a military chain to a military customer asking military questions.

The American Half of the Ledger

Washington read Russian intent correctly, but got the second question wrong.

Almost every Western service, American ones included, assessed that Kyiv would fall in days. The Chairman of the Joint Chiefs told members of Congress that the capital could be taken in seventy-two-hours. The day after the invasion began, US officials were still assessing that Kyiv could fall within days. The intelligence community later reviewed what went wrong, and the answer was not the Russian side of the equation.

Examine how that assessment was built. Analysts counted Russian formations and Ukrainian formations, compared readiness and equipment, ran the correlation of forces, and derived an outcome. It was rigorous, and every input was real. What it failed to weigh was whether Ukrainians would fight for their country, and misjudged the national will of resistance.

That is mirror-imaging pointed at a friend instead of an adversary. In the European case, services assumed Putin would calculate cost the way a Western government would and concluded he would not invade. In the American case, services assumed Ukrainians would calculate survival the way a defeated army could and concluded they would not hold. Both times, the arithmetic was correct and the human judgment underneath was imported from somewhere else.

Within two weeks of the invasion, the United States and its allies were quietly planning for a Ukrainian government in exile and an insurgency, which is the posture you adopt when you have concluded that the state will stop existing. Zelensky was reportedly offered evacuation and answered that he needed ammunition rather than a ride. The pessimism shaped what was planned, what was offered, and how fast it moved, in the weeks when speed mattered.

In the other direction, Zelensky spent the run-up publicly disputing American warnings, arguing that the alarm was doing more damage to his economy than the threat. Biden later said Zelensky simply “didn’t want to hear” it.

Washington was right about Russia and could not get Kyiv, Berlin, Paris or Stockholm to act. Kyiv was right about Ukraine and could not get Washington to believe it. The problem caused both an unprepared Europe and delayed American aid.

What Sweden is Actually Building

Former Prime Minister Carl Bildt led the review of Sweden’s Intelligence Failure, “En reformerad underrattelseverksamhet”. The report stated that Sweden was unusual among comparable allies in having no foreign intelligence service outside of the military chain of command reporting to the elected government. The country had excellent military intelligence, a capable security service (Sapo), and one of Europe’s better signals organizations (FRA), but no institution capable of reading political intent. The report recommended a civilian agency directly under the Foreign Minister, which was later approved.

Sveriges utrikesunderrattesetjanst, UND, will sit alongside MUST, Sapo and FRA rather than replacing any of them, and is meant to be a senior shop rather than a second MUST, growing over several years.

UND takes over KSI, the Office for Special Collection, which is Sweden’s clandestine human collection and which operates in other countries under cover employment and false identity. It also takes over the production and management of qualified protected identities, previously run by the Armed Forces. The legal architecture moves with it: the Defense Intelligence Court is renamed and the oversight body redesignated, moving Sweden closer to the structures of MI6 or Estonia’s Valisluureamet: a small, civilian, politically literate foreign service.

The government named Andreas von Beckerath director-general and Annika Brandstrom his deputy, both running from January 1, 2027 for six years. Von Becherath is a diplomat: with ambassadorships in Ukraine and Poland, deputy director-general and head of the Foreign Ministry’s Eastern Europe and Central Asia department, with earlier postings in Moscow, Bucharest, London, Berlin, and New York. He is currently serving as the European Union’s ambassador in Belgrade, head of the EU delegation to Serbia, a post he has held for a year.

Brandstrom ran the inquiry that stood the agency up and served as deputy national security advisor. She has a long history of working in crisis management, preparedness and security, working directly for the Prime Ministers office.

The diagnosis was that Sweden could count Russian tanks but not read Russian politics. The team hired to fix it spent their careers reading politics and managing crises. Sweden did not appoint a general, nor an intelligence officer. It appointed a diplomat and a bureaucrat, showing that the government took the review seriously.

Frictions and Objections

Thomas Nilsson, who runs MUST, said that in the current security situation Sweden cannot afford to let anything fall through the cracks. Supreme Commander Michael Claesson has noted that UND’s civilian funding may not count toward NATO spending targets. Analysts have pointed to the seam that any civil-military split creates, which a capable adversary will probe.

All of Sweden's eight parties on the foreign affairs committee backed the legal changes. Four of them, the Social Democrats, the Left, the Greens and the Center, filed seven reservations and three separate statements. The Social Democrats called four months an extremely brief period for a reorganization of this size. The Left said the process may create more problems than it solves. The Center Party called it democratically flawed.

Underneath the procedural language is a specific operational worry: KSI leaves MUST. The Social Democrats’ objection is that the military loses a capability and is not compensated for the loss. Clandestine human collection is not a function that transfers on an effective date. Cover takes years to build and one administrative error to destroy. Officers working abroad under false identity are being re-subordinated to an agency that does not exist yet, whose director arrives on the day it opens, in the same window in which US intelligence says Russia may test the alliance.

Recruitment began before parliament formally approved the agency. The Social Democrats' complaint was tied to former hiring flaws for the National Security Advisor. Naming a year leadership team weeks before a national election, after declining to seek cross-party agreement, was provocative. They have a point; the decision was taken hastily in a political setting that often favors alignment across the aisle.

As a result the opposition signaled it may revisit elements of the reform, and the Swedish reporting has been blunt that if an incoming government shelves the service, three years of work goes with it. While the diagnosis is correct and the institutional design is sound, the infrastructure has to survive the people who built it, and whoever wins the next election. Sweden’s diagnosis was that its intelligence architecture was wrong for the threat. The risk now is that the new institution is not properly aligned across the aisle.

What Washington Should Do, and What Stockholm Should Ask For

Sweden is fixing the half of 2022 that was Sweden’s. Nothing in the American half has been fixed, and standing up a new allied service is a rare occasion when that half becomes cheap. None of what follows requires an appropriation.

Engage the institution, not the government. The appointed leaders will outlast the government that named them. American engagement pitched at the service and its career leadership must survive a change in Stockholm. Engagement pitched at the ministers who created UND does not, and given how the reform was legislated, engagement that looks like an endorsement of the current coalition would actively damage the agency’s standing with the parties most likely to inherit it. The correct posture toward a new foreign intelligence service in an election year is professional and studiously boring.

Establish liaison at the founding. A service’s analytic culture and its foreign relationships set early and then harden. What UND treats as a finished intelligence product, how it handles dissent, what it considers sufficient evidence to warn a prime minister, and whose reporting it trusts will all be settled in 2027 and 2028 by people who are being hired. Washington should be in the room while the habits are forming, and the subject of that liaison should be intent rather than order of battle, because reading intent is the entire reason the agency exists.

Make the 2022 improvisation permanent. The declassify-to-persuade campaign that Washington and London ran that winter was invented under pressure, with skill, and then set aside. A standing mechanism for releasing intent-grade material to allies at speed, with the handling rules and the release authorities agreed in advance would mean the next warning arrives in a form that an ally can act on. The lesson of 2022 was that being right in February is worth little if the ally does not move until April.

Settle the accounting question now. Claesson’s concern that UND’s civilian budget may not count toward NATO spending targets is an alliance question. The Hague summit’s target splits into 3.5 percent for core defense and 1.5 percent for defense-related spending, and the substance of that 1.5 percent has not been well-defined. Washington has more influence over that definition than any other member. A civilian foreign intelligence service whose product feeds alliance warning belongs in the basket. If it does not, the alliance will have told every member that the safe answer is to keep intelligence in uniform, maintaining the structure that failed in 2022.

Clarify Expectations. Sweden should ask for written handling and onward-sharing terms at the foundation, when it has maximum leverage and when the terms can be built into the agency rather than bolted onto it. It should ask for reciprocal analytic exchanges, including joint red-teaming aimed specifically at mirror-imaging, which is the failure both services can share and neither can audit alone.

Assign UND a responsibility in NATO. A small service does not compete across the whole target set, but Sweden has geography, language, history, and now a reputable and capable director. UND should come to the table as the alliance’s lead on a defined portion of the Russian problem rather than as a recipient of American products. Partners who bring something are listened to.

A Warning is Not a Decision

Sweden has looked hard at their failure and built an institution in response, which is more than most European governments have done with the same four years. The review named the problem, the legislation moved clandestine collection out of uniform and under civilian control, and the government hired a team with experience reading exactly the kind of politics that can accurately foresee an invasion.

The failure of influencing has no institution behind it in Washington or elsewhere. It was solved once, improvised under pressure in the winter of 2022, and allowed to lapse. That is the part of 2022 that is genuinely fixable, but it needs to be assigned. The American task is to build a relationship durable enough that whoever party runs Sweden does not matter.

Burns flew to Moscow in November 2021 and came home with a warning that proved correct, and it moved nobody in time. Ratcliffe made the same flight in August. The question worth asking is not whether the assessment behind it was accurate. The question is what happens after he lands, and whether four years, a war, and a new agency in Stockholm have changed the answer at all.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

At the 25^th anniversary session of the Shanghai Cooperation Organization (SCO), Chinese President Xi Jinping proposed an alternative model to Western alliances.

Mr. Xi urged developing nations and the Global South to leverage “SCO wisdom” to argue for a more equitable and orderly multipolar world and reform of global governance institutions like the United Nations. The Secretary General of the United Nations, Antonio Guterres, and other guest delegations were in attendance for this anniversary session of the SCO.

The 26^th meeting of the Council of Heads of State of the SCO convened on September 1, 2026, in Bishkek, Kyrgyzstan. Leaders from the 10 member states (China, Russia, India, Pakistan, Iran, and Belarus and the four Central Asian nations) signed the Bishkek Declaration and 13 other documents dealing with security, technology and anti-drug cooperation.

Mr. Xi committed China to provide localized technical projects, collaboration on Artificial Intelligence with SCO member countries and alignment through the Belt and Road initiative (BRI), a massive global and economic strategy proposed by Mr. Xi in 2013. (The BRI, with 146 member states, seeks to link Asia, Europe, Africa, and Latin America through a network of ports, railways, roads, and energy pipelines. The World Bank and other studies claim that BRI transport projects have lowered trade costs, integrated developing regions into global supply chains, increased local GDPs and lifted millions out of moderate poverty. Critics claim that aggressive, large-scale lending by Chinese state banks have saddled several developing nations with heavy external debt burdens).

Mr. Xi talks about alternatives to Western alliances and creating multipolar institutions, an appealing message to developing nations and the Global South.

It is ironic, however, that two of the 10 members of the SCO, Russia and Iran, are pariah states. Russia’s invasion of Ukraine in February 2022, despite security guarantees provided to Ukraine after they sent all their nuclear warheads to Russia; and Iran, a state sponsor of terrorism that, in 1999, 2009, 2019, 2022, and 2026, killed thousands of peaceful protesters.

A new alliance between Turkey, Saudi Arabia, and Pakistan – the Mecca Defense Alliance – was established in August 2026. Indeed, this is an unprecedented alliance of three U.S. allies’ intent on building a security architecture independent of the U.S.

The BRICS (Brazil, Rusia, India China, and South Africa), formed in 2006, has 11 members, with more than 30 countries that either applied or expressed interest in becoming a member.

It appears that Mr. Xi’s exhortations for a more multipolar war resonates with several developing countries and the Global South, despite the inclusion of Russia and Iran in the SCO and BRICS.

Mr. Xi is competing with several U.S. led international organizations: the QUAD (Australia, India, Japan and the U.S.), AUKUS (Australia, the United Kingdom, and the U.S.), and NATO. Indeed, NATO (North Atlantic Treaty Organization) was established in April 1949. It’s mission: to safeguard the freedom and security of all 32 member countries through diplomacy and military means. Article 5 of the NATO charter is clear: An armed attack against one member is considered an attack against all of them.

Any real or perceived tension between the U.S. and member countries within NATO, the QUAD or AUKUS will make Mr. Xi’s efforts to create “an orderly multipolar world”, with China in the lead, more attractive to developing countries and the Global South.

The U.S. has played a global leadership role after World War II. The Marshall Plan, established by the U.S. in 1948, provided $13 billion to help rebuild Western European economies.

And it was U.S. leadership in 1949 that established NATO.

Our allies and partners continue to look to the U.S. for this type of global leadership. And developing countries and the Global South should be looking to the U.S. as the democratic leader they should emulate and work with.

The author is a former Associate Director of National Intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. government.

This piece was originally published in The Washington Times.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

As NATO leaders gather in Ankara this week, the alliance faces a myriad of security challenges unlike anything it has confronted in decades.

With Russia's war against Ukraine raging on and instability in the Middle East following the conflict with Iran, President Donald Trump continues to press European allies to take on more of the burden for their defense. This all comes to a head in Ankara, where Turkey finds itself at the center of the alliance's most pressing strategic concerns. Taken together, the issues confronting leaders at this week's summit extend well beyond the traditional debates over defense spending.

"This is a great opportunity for Türkiye," retired Lt. Gen. Ben Hodges, former Commanding General of U.S. Army Europe, told The Cipher Brief. "Finally many Allies will have the opportunity to better appreciate the strategically vital role that Turkey plays for NATO due to its geography as well as its defense industry and military capabilities." The changing perception of Turkey's role in the alliance represents quite a shift.

Only a few years ago, Turkey's relationships with many NATO countries were strained over its purchase of Russia's S-400 air defense system and disagreements over admitting new countries into the alliance shortly after Russia's invasion of Ukraine in February, 2022. Today, NATO looks to expand defense production and strengthen its southern flank.

Russia's war continues to shape NATO's priorities

The urgency surrounding Russia is likely to dominate the conversation in Ankara.

Another deadly wave of Russian missiles and drones struck Kyiv just hours before the summit, killing 21 people and injuring at least 77 more. President Volodymyr Zelensky is expected to seek additional Western air defense systems, particularly U.S.-made Patriot interceptors, during meetings with allied leaders. Beyond Ukraine itself, many in the alliance predict that Moscow will continue testing NATO's resolve across Europe.

"There is a recognition, regardless of what President Trump says when he speaks tomorrow, that this meeting has to set major new directions for cooperation between NATO allies," former senior British diplomat Nick Fishwick, who is attending meetings in Ankara surrounding the summit, told The Cipher Brief.

"Most people recognise that the days when European allies could freeload on massive U.S. security support have come to an end," Fishwick said. "European allies are now committed to spending two or three times the amount of GDP devoted to defence in 2015."

European governments are increasingly acknowledging that spending more money is only half of the equation, while rebuilding defense industries and coordinating military planning across the alliance have become equally urgent priorities.

"We Europeans have to find ways of cooperating, sharing and communicating in an age of hybrid warfare and AI-enabled cyber attacks," Fishwick said.

Beyond defense spending

President Trump is expected to arrive in Ankara seeking commitments from allies to meet NATO's new defense investment targets.

Retired Adm. James Stavridis, former Supreme Allied Commander Europe, believes the summit's greatest achievement may be just preserving the alliance's unity.

"The most important thing is simply that there are no huge blowups," Stavridis told The Cipher Brief. "Worrisome issues include fundamental disagreements about operations in Iran; the pace of European defense spending; support to Ukraine, both diplomatic and military; and the lingering negative effects of the U.S. moves on Greenland."

One area where Stavridis sees potential progress is maritime security, particularly after recent instability in the Middle East. He said President Trump would likely welcome a European commitment to participate in operations protecting commercial shipping through the Strait of Hormuz.

Stavridis also said allies should move past broad spending pledges and begin outlining specific plans for expanding Europe's defense industrial base. Just as important, he said, should be addressing threats that increasingly blur the line between peace and war, or as we like to call it, the "Gray Zone".

"A robust discussion about how to counter increasing levels of hybrid and grey zone activity specifically including anti-drone cooperation would be meaningful," Stavridis said. "I would also hope to see some discussion of the role of the alliance in cyber security because the likelihood of Russian hybrid operations in that zone is significant and rising."

For Hodges, success in Ankara should be measured by whether the alliance shows that its members remain aligned on the issues that matter most to their collective security.

"A strong endorsement of Ukraine and the strategic importance for all NATO Members that Ukraine is successful in its war with Russia, with commitments of resources and capabilities from everyone, including the USA, to Ukraine," remains essential, Hodges said.

Whether leaders can deliver that message, and Trump's often unpredictable approach to NATO, will cement how this summit is remembered.

The gathering in Ankara is unlikely to produce any severe dramatic breakthrough. But at a time when Europe faces its most serious security environment in a generation, maybe it's enough for the alliance to demonstrate that it is capable of remaining united.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief