NATO Allies have bet the future of European skies on the world’s most sophisticated combat aircraft. NATO Allies are buying the world's most advanced fighter but many are neglecting vital investments in hard security, ground crews, and support systems that will keep it flying.

By 2028, European flight lines will host upwards of 700 F-35 Lightning jets. On paper, this inventory represents an insurmountable technological edge: a sensor-fused, fifth-generation fleet that outmatches any potential adversary in radar-cross-section, situational awareness, and electronic attack.

Yet this procurement spree masks a dangerous complacency. The Alliance has poured vast capital into acquiring fifth-generation airframes while systematically underinvesting in the unglamorous terrestrial infrastructure that keeps them flying: base hardening, counter-drone defenses, resilient networks, and ground crews. An F-35 sitting on an unhardened runway without fuel, parts, or secure command links is not a deterrent, it is an expensive target.

The cockpit may deliver tactical lethality, but operational endurance is generated entirely on the tarmac. If conflict erupts with Russia, the fight for European airspace will look less like a sterile, high-tech turkey shoot and more like the grueling attrition of the Battle of Britain.

Surviving Day Zero

Historically, the most efficient method of destroying an air force has rarely been in air-to-air combat; it has been catching it on the ramp. Operation Focus in 1967 wiped out Egypt’s air force before breakfast. Conversely, Ukraine averted immediate disaster in February 2022 because it aggressively dispersed its scarce aircraft and mobile air-defense batteries hours before Russian cruise missiles slammed into permanent garrisons.

Recent innovations have further collapsed the boundary between frontline and rear sanctuary. In June 2025, Ukraine demonstrated the democratization of deep strike with Operation Spiderweb, deploying commercial-style drones smuggled deep into the Russian interior to strike strategic bombers parked in the open. The threat bypassed layered air defense belts entirely; it originated outside the airbase perimeter fence. Coupled with intelligence reports of sabotage devices targeting logistical hubs in Western Europe, such as the attempted strikes near Leipzig, the implication for NATO is clear: rear sanctuary no longer exists.

Russia has studied these dynamics carefully. A coordinated "Day Zero" assault will not rely solely on long-range Iskander or Kalibr barrages. It will combine standoff salvos with covert proxy drone launches, special reconnaissance sabotage, and electromagnetic disruption targeting key airbases before any formal declaration of Article 5. If NATO’s F-35 fleet remains concentrated at sprawling, unhardened hubs, the Alliance risks losing the air war before its pilots can take off.

Survival on Day Zero will not come from a single system. Ground-based air defense will kill aircraft, cruise missiles will crater runways, and drones will hunt anything left in the open. The answer is dispersal, concealment, and resilience, practiced and exercised daily long before the shooting starts.

A Battle of Britain, Not a High-Tech War in the Air

The operational template NATO must internalize is not Desert Storm, but southern England in the summer of 1940. When the Luftwaffe hammered RAF sector stations across Kent and Sussex - cratering Biggin Hill, Manston, and Kenley - the British survived because of an integrated, highly resilient system.

It was not the Spitfire alone that preserved Britain; it was the Dowding System. Radar stations, visual observers, filter rooms, and telephone lines fused intelligence into an actionable operational picture and directed scarce interceptors to precise intercept vectors. Crucially, the system was distributed and made redundant. When individual nodes went dark, the architecture adapted. Meanwhile, exhausted ground crews patched runways and re-armed aircraft under constant threat of bombardment.

NATO faces an analogous network challenge today. The F-35 is a formidable intelligence-collection platform, but its utility plummets if its Multifunction Advanced Data Link (MADL) cannot pass target tracks to legacy fourth-generation fighters, naval surface combatants, or ground-based air defenses under heavy electronic jamming. If a Combined Air Operations Center (CAOC) is knocked offline, who assumes control of the theater airspace? Without distributed, jam-resistant data architectures and mission command protocols for degraded environments, tactical technological dominance will dissolve into operational paralysis.

Operational Imperatives for NATO Airpower

If NATO intends to build genuine deterrence by denial, member states must balance platform acquisition with systemic survivability across five core areas:

1. Institutionalize Dispersal and Agile Combat Employment (ACE): Finland and Sweden have long mastered highway-strip operations, rapid turnaround, and camouflage doctrine. These must cease to be High North novelties and become standard operating procedure across all Allied air forces. Peacetime operations must routinely exercise dispersed sortie generation from municipal airports and road networks.
2. Harden the Perimeter and the Flight Line: Every euro invested in advanced airframes must be matched by funding for base survivability: point-defense against low-altitude UAS, hardened aircraft shelters, mobile arrestor gear, rapid airfield damage repair (RADR) kits, and deep magazines of precision munitions.
3. Expand Logistics at Strategic Depth: Dispersed operating locations demand rapid logistics and robust aerial refueling capacity. Staging fighters farther from the contact line requires a dramatic expansion of NATO’s multinational tanker fleet and hardened pipeline distribution networks.
4. Solve the Cross-Domain Data Mesh: Allies must field resilient, low-probability-of-intercept gateways that translate fifth-generation sensor data into common operational pictures accessible to non-stealth assets and ground-based integrated air and missile defense systems. They also need the ability to protect and secure their entire EW spectrum, given the F-35's massive reliance on it.
5. Re-arm and Re-train the Ground Crew: The maintainer, armorer, and combat engineer are frontline combatants. NATO must equip ground personnel with specialized force-protection capabilities, chemical-biological-radiological-nuclear defense gear, and the cross-training required to generate combat sorties in austere, contested conditions.

The True Cost of Deterrence

Deterrence is not measured by the sophistication of one platform; it is measured by the credible ability to absorb a first strike and generate combat power under fire. Building that credibility requires realistic, high-tempo exercises in harsh weather, degraded communications environments, and austere road bases. It must be under conditions that carry legitimate operational risk and wear on equipment.

Before 1989, this operational friction was the routine cost of doing business in Allied Air Forces Central Europe. The pilots of 1940 earned their place in history, but unheralded mechanics, plotters, and engineers preserved their freedom to fight. As NATO retools for contested collective defense, it must remember that fifth-generation air power is only as resilient as the ground beneath its wheels.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

“What does Ukraine really need? How do we make sure they're delivering what they actually need? And you know, right now those are air defense munitions, it's funding for drones, it's extended range artillery, electronic warfare, etc. And then the other big thing was to try to improve predictability because, you know, Ukraine could only plan operationally, if they knew what they were getting. And so how could we help better inform their planning efforts and their ability to operate together?”

That was just-retired -- on October 1-- Army Lt. Gen. Curtis Buzzard, most recently the former U.S. Commander of Security Assistance Group – Ukraine (SAG–U) and NATO Security Assistance and Training for Ukraine (NSATU), speaking last Wednesday on the Center for Strategic and International Studies (CSIS) streaming podcast, The Last Line of Defense.

Being in charge of both these headquarters, located in Wiesbaden, Germany, Buzzard said he had traveled to Ukraine “some 30 times” over the past two years and was able to “develop close relationships with government officials, with the general staff, with units, and really watch them evolve over this period, visit the unmanned systems force, [and] visit some of these underground command posts.”

As a result, he said, “I think this is the most consequential environment to observe the evolution of warfare right now. And it really gave me firsthand observations about the future of war. It's really an action, reaction, counter-counter-reaction at an incredible pace.”

After Russia’s February 2022 invasion, Ukraine has turned it into “a brutal contest of wills,” Buzzard said, adding, “Who would have imagined they've [the Ukrainians] essentially halted the Russian offenses, and Russia's not accomplished a strategic objective in this war yet. And the Ukrainians have been doing this largely with innovations in unmanned systems, particularly drones.”

Buzzard confirmed reports that Ukrainians “largely have stopped Russian advances and these continued attacks are at great cost to Russia.” He continued, “You know over 30,000 [Russian] casualties a month generally and, from reporting, over 60 percent are fatalities. So this is incredibly lethal and that costs Russia money to recruit and to pay death gratuities.”

But it were the details that Gen. Buzzard went on to describe that made his presentation most interesting.

For example, Buzzard said, “When when anybody wants to talk about employing unmanned systems [in Ukraine]…I'd say the secret sauce is really Delta. It's this mission command system that enables them to be…fast, flat, and accurate [with] over 200,000 users -- on a handheld device like your cell phone or a tablet.”

Developed by Ukraine’s Centre of Innovations of the Ministry of Defense and Aerorozvidka, a prominent Ukrainian civic-tech volunteer NGO and military unit specializing in aerial reconnaissance, Delta is a cloud-based, modular situational awareness and battle management system that gathers and integrates data from diverse sources, and mapping it in real time.

Buzzard said, “I used to carry [a] tablet with layers of intelligence so you can see where the enemy is. You can coordinate missions. You can do targeting on there. You can also see every drone feed, and they've got an app called Vasia which allows you to ingest every drone feed, so you're not having to [deal with], you know, proprietary computers with imagery or whatever.”

Actually, Vasia, according to her Instagram, is the call sign of vasylynanakonechna, a well-known female drone operator and the Deputy Commander of a UAV unit within the Ukrainian Armed Forces called the White Demons. “War is brutal and dangerous,” she has written, “but our goal is simple: risk technology instead of people whenever possible.”

Buzzard last Wednesday continued saying of Delta, it “allows them to fight so fast and rapidly upload BDA. I mean battle damage assessment. Yeah, to rapidly upload what they've just done, and then using that data to better understand what tactical effects they've had on the battlefield.”

Buzzard identified “the guy that's really remarkable doing this” was Major Robert Yosypovych Brovdi , Commander of the Unmanned Systems Forces of Ukraine, “who was a businessman three years ago, a grain trader, art dealer.”

Buzzard went on, “I mean, his [Brovdi’s] underground command posts are kind of a surreal experience because you're watching essentially like a Vegas stream of what effects they're having on the battlefield in terms of destruction of enemy. And then there's this incredible piece of art with a QR code [quick response matrix bar code] on it where I could look up the history of it.”

“You know,” Buzzard said, “they're sitting on the world's best combat data when you think about all the imagery feeds, all the understanding of Russian attacks into Ukraine and what routing speeds -- you know all this stuff. And so there's opportunities to work with them to use this to inform aided target recognition…to support Ukraine first and foremost, but also to learn ourselves. There's a professional responsibility to do that. This data in particular reinforces this idea of a lab, a battle lab that this fight in Ukraine is kind of like the Silicon Valley. I mean, they already had a real knack for technology and innovation.”

I should insert here that Buzzard also said Ukraine drone companies put a QR code on each drone.

“So, if you're out on the front,” he continued, “you get a drone from a company and there's something wrong with the drone, you scan the QR code; it'll go right back to a 24-hour op center of a Ukrainian company; then probably down to a team that's there to help you out; or you may even talk to them right away. And then, if it needs to be adjusted, they're probably changing the production line within 48 hours. So you know how to adjust that rapidly or if the [radio] frequencies change how rapidly they got to change what frequencies are on. So just an incredible amount of innovation [arrives] at a pace that is important and gives you combat advantage quite honestly. And so I got to think about how do we learn from this?”

At one point, Buzzard said, “The number one thing I've learned, and a lot of people would ask, is it technology, you know, drones, is it whatever? It's this velocity of learning that the Ukrainians demonstrate -- from observing, to learning, to adapting. to then fighting it again. This loop, action, reaction, counter-action, is just unbelievable. And I think it equates to combat power. And when you look at a lot of the success they've had on the battlefield, it's due to their own innovation.”

For example, he said the Ukrainians “didn't have enough mid-range strike capabilities, so they invented their own…There weren't enough interceptors to engage [Iranian-designed] shaheds.” These were one-way attack unmanned combat aerial vehicles and loitering munitions and now there are jet-powered shaheds.

Buzzard went on, “So they created their own. They created drone interceptors which actually from a cost standpoint are tremendously cheaper than what it would normally cost,” adding, “And they've really kind of mastered, I would argue, the cost of war -- developed cheap attritable [interceptors] because they haven't had expensive and exquisite. And I think that's an important lesson for us to learn, you know, what's the right balance of that, and how do you layer this capability with some of the very exquisite stuff that that we have also.”

Buzzard also noted, “It's just unbelievable how quick they iterate. As you look at some of the [Ukraine] long-range strike with drones, you know, even over the course of several months, it's a different drone, a different technique…What's used in the latter, you know, an earlier and a later one as you compare these things.”

He also noted “some incredible innovation particularly in the middle, deep-strike [drones], and then they're learning a lot just about how to do this. How do you weave through the electromagnetic signature, the EW [electronic warfare], the air defense; what's the right weapon to target pairing? What's the type of redundant network? How do you dynamically control all kinds of other things that I think would be hugely valuable for us, but again it all comes back to that velocity of learning from unit to industry to government funding.”

Buzzard also talked about some Ukraine counterattacks that have not gotten much public attention in the U.S.

“Right now,” he said, “there's one,Operation Vivaldi, a lot of folks are talking about with [Ukraine’s] Third Army, Gen. [Denys] Prokopenko down at Donetsk had done counterattacks, and Gen. Oleh Apostol, the Airborne Commander down south had done them in Zaporizhzhia.”

Buzzard continued, saying, “They've been taking back terrain too in the midstrike [areas] that's been very effective, about 20-to-30-to-150 kilometers, to help relieve pressure on the front so they've been very effective at striking logistics nodes, command and control, etc., electronic warfare.”

Buzzard also talked of “Ukrainians deep strike into Russia, most of that's with indigenous capabilities and a ton they've learned on just how to execute that. But that's clearly had an impact. Also, most recently, these huge logistics sites, Wildberries.” The latter, Wildberrries,

being Russia's largest online marketplace, and the attacks are part of a Ukraine campaign to disrupt Moscow's wartime economy.

Buzzard concluded, “So collectively I think this all aggregates to be military pressure, economic pressure [on Russia]…You know if I'm inflicting a lot of [Russian] casualties on the front, he's [Putin] potentially losing terrain. His economy is getting worse every day. Ideally at some point would he think that a deal today is better than a deal tomorrow?”

Buzzard went on to speculate, “And I don't know whether that'll actually end up happening or not, but they're [the Ukrainians] certainly in a position that in terms of what they're doing and I think these long-range strikes you're seeing from Russia to Ukraine now are really somewhat of desperation, because they're not achieving anything on the front or very little gains. And so the only thing they [the Russians] can do, and a lot of its impact is due to [shortage in Ukraine of] global supply of air defense interceptors, is [for Putin] to strike into Kiev and make it seem like they're more effective [against Ukraine] than what they really are.”

Buzzard presented a more optimistic view for Ukraine than I see, in part because he has left out President Trump’s recent moves that favor Putin and the Russian side. I don’t believe that either Putin or Trump know what’s going to happen next. Only Ukraine President Volodymyr Zelensky seems to have a set path, and that is to continue defending his country by seeking continuing aid from supportive countries.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

On October 15, a Vietnamese state-owned tanker, the PVT Azura, departed St. Petersburg with 109,000 barrels of Russian diesel. It is due at Norfolk on November 2, at a facility that the shipping journal gCaptain reports serves the American military, a detail no official has confirmed. It will be the first Russian diesel to reach an American port since 2023. On October 23, Russia's deputy prime minister said three tankers were at sea, that supply contracts were being finalized, and that volumes would rise to 1 million tons in December and could reach 3 million a month. A week earlier, the United States had waived, by executive order, the duties Congress had required to punish Russia's energy customers. Within a week, the waiver became a contract.

Azura's cargo is about 40 minutes of American diesel demand; 3 million tons a month would be a fifth of it, and roughly four times what Russia exported in the third quarter. To deliver that, Russia must repair the refineries Ukraine has spent a year destroying, which Rosneft now says it cannot afford. The contract's first effect is to give Washington an interest in Russian refineries running, even as Ukraine's president says the interceptors it has already paid for "are still not coming."

Diesel is one of four things the arsenal took this autumn from parties it does not control. The second is magnets: China exported 6,165 tons in September, its largest month this year, and they are the magnets in the motors of the drones the new Autonomous Warfare Command is to buy by the hundreds of thousands; Beijing's pause on its licensing rules lapses on November 10, with no notice published. The third is a room: the President said on October 19 that he would meet Vladimir Putin and Xi Jinping in China next month, after the Wall Street Journal reported that Putin had proposed a three-way meeting in Shenzhen to settle the war in Ukraine, without Ukraine. The fourth is money: on October 21, the Treasury sold 20-year bonds at a record 5.469 percent with foreign demand well below its average, and the 10-year fell below 5 percent the next day only because investors fled artificial-intelligence debt for the government's.

The one adversary with nothing to sell was squeezed: a third carrier group was ordered toward Iran on October 21, and Brent settled Friday at $116.72, its highest since April, which raised the price of everything the arsenal buys from the adversaries that do sell.

A sanction is the instrument of the party that sells. This autumn, the United States is the party that needs, and each supplier holds a date on which it can change the terms: October 31, when Russia's own fuel-export ban lapses; November 10 for Beijing's licenses; early November for the Treasury's refunding; November 18 for the summit. In economic warfare, the buyer takes the terms.

I write this from the Cipher Brief's Threat Conference at Sea Island, where General Bryan Fenton and I addressed the question of what the Department of War has to do with economic warfare. The week answered it before we spoke: the Department is now, by available reports, a customer of one adversary's refineries, a buyer of another's magnets, the holder of an ally's interceptors, and the owner of the carriers that set the price of oil. No office weighed those instruments against one another; the suppliers did.

For nine weeks in these pages, I have written about what the United States cannot do, from the army it cannot command to the day it cannot choose, and each piece ended at the same place: a decision no one was assigned to make. The diagnosis is complete, and the series turns here from what we cannot do to what we must. The place to start is the Autonomous Warfare Command: its plan is due on October 30, and it will be the government's largest buyer of the parts this piece is about.

Three things must be in that plan, and none of them is money.

First, the authority to decide. The Secretary's memorandum settles who buys. It has not settled who decides: one command-and-control architecture across every Service and domain, including space; who allocates among theaters when two ask for the same drones on the same day; who overrides at tempo; and whether the answer binds the Services. Congress granted those authorities to Special Operations Command in 1986, with its own budget line and acquisition power. The plan should name the same for this command, and add the paragraph Congress left out in 1986: command and control.

Second, the edge. Ukraine computes on the aircraft; we compute in Virginia and wait, and the Pacific cannot fight on a round trip. The plan must put the computing on the platform and the communications on a layer the force controls, so that no one else sets its speed.

Third, supply before the ban. The command's motors turn on Chinese magnets until American plants deliver, and the Pentagon's own ban takes effect on January 1. A Defense Production Act priority rating and a drawdown from the National Defense Stockpile, issued before November 10, stock what we need before we forbid what we depend on. The same plan is the demand signal industry has asked for: an architecture and a date.

—

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

On the morning of October 23, the cargo ship Khoryv sent a distress call 13 nautical miles off Constanța, Romania. Territorial waters end at twelve. Whoever flew the drone that sank her knew where the line was, and chose to stand one mile outside it.

That mile is the story. It is the difference between an attack on a NATO member and an incident in a NATO member's exclusive economic zone. It is the difference between Article 5 and a press release. The London insurance market understood this before most capitals did. When the Joint War Committee extended its Black Sea listed area on September 16, it covered the entire sea except the territorial waters of Bulgaria, Georgia, Romania and Turkey. The underwriters drew the same line the drone operators did. Nobody should find that comforting.

This is what gray zone conflict looks like. Freighters burning off the coasts of two NATO allies, sailors lost in cold water, and attacks clustered around the Sulina Channel, which became the main outlet for Ukrainian grain after Russia hammered Ukraine's own ports. It is war at a time and place of the attacker's choosing, priced just below the point where anyone is obliged to do anything about it.

"The problem is that we cannot prove it"

Bulgaria's prime minister, Rumen Radev, is nobody's idea of a Russia hawk. He told his parliament the logic of the attacks points to Moscow, and then said the quiet part out loud: "The problem is that we cannot prove it."

NATO's response has been built to solve Radev's problem. After the North Atlantic Council met on October 20, the Alliance announced it would send maritime patrol aircraft, radar, drones, intelligence personnel and forensic teams to examine the explosives. A U.S. Navy P-8 Poseidon is already flying the Black Sea. These are sensible deployments. They are also answers to the wrong question.

Play the scenario out. Grant NATO perfect attribution. The forensic teams recover a guidance board with Russian markings. The P-8 tracks a launch back to a known site. The Alliance announces, with high confidence, that the Russian Federation sank the ship. Now make it worse: the next drone hits a tanker alongside the pier at Constanța, the fire spreads, and thousands of civilians are dead.

The Kremlin denies it. Within the hour, Russian state media points at Kyiv, and it doesn't have to work hard to sell the story. Ukraine has been running its own maritime drone campaign since July, so the Black Sea is full of Ukrainian drones, and everyone knows it. A few Western commentators find the denial "plausible enough to warrant caution." Allies invoke Article 4 and consult. Statements are issued. Sanctions, already near their ceiling, are tightened at the margins. Then nothing happens, because every capital in the room is doing the same arithmetic: Russia has nuclear weapons, the Black Sea is not worth a war, and the dead are already dead.

You don't have to imagine that sequence. We ran it on July 17, 2014, when a Buk missile destroyed Malaysia Airlines Flight 17 over eastern Ukraine and killed everyone aboard. A Dutch-led investigation established in 2016 that the launcher had been delivered from Russia, and by 2018 that it came from a Russian army unit. The ICAO Council found Russia responsible in May 2025. The European Court of Human Rights did the same that July. Moscow denied all of it, spent years promoting theories that blamed Ukraine, and in 2022 invaded the country the missile had been fired over. Attribution was as good as attribution gets. The consequence, eleven years later, was an order to enter into good-faith negotiations on reparations.

That is the lesson Moscow took from MH17, and it is the one we refuse to learn. Deniability is not a shield for the attacker. It is a gift to the defender who would rather not act. Russia doesn't need us to believe its denials. It only needs us to want to.

Operational freedom is the target

The point of these strikes isn't the ships. It's the water around them. Every hull that burns off Sulina raises the premium on the next one, pushes a charterer toward a different route, and teaches a shipowner that a NATO coastline offers no protection. The attacker never has to declare a blockade. The market imposes it for him. Freedom of action shrinks by increments, each too small to justify a response, until the defender wakes up to find that the sea he was sure he controlled has a new landlord.

This is how Russia and China will impose costs on the West for the foreseeable future. Not with the decisive battle our doctrine, our budgets, and our military exercises are built around, but with a steady accumulation of incidents chosen for their deniability, timed to our distractions, and calibrated to our fear of escalation. Salami slicing is not a new idea; Beijing has practiced it in the South China Sea for more than a decade. What's new is the drone, which makes the slicing cheap, precise and anonymous.

The honest complication

The Black Sea gray zone is not one-sided, and pretending otherwise hands Moscow its talking points. Ukraine's Operation Molochka, launched in July, claims to have disabled 300 Russian-linked vessels in the Black and Azov Seas. Turkey's foreign minister says both sides are mounting heavy attacks to establish superiority before winter.

The distinction holds. Ukraine is striking the logistics of the country that invaded it, mostly sanctioned tankers serving Russian ports and occupied Crimea. Russia is striking grain ships in the economic zones of two NATO members that are not party to the war, with the apparent aim of making Ukraine's last reliable export route uninsurable. One is a belligerent waging war at sea. The other is exporting that war to the Alliance's doorstep and daring it to notice.

Taiwan won't look like Hellscape

If you want to know what a Taiwan conflict will look like, watch the Black Sea.

In 2024, Adm. Samuel Paparo said he wanted to "turn the Taiwan Strait into an unmanned hellscape" to defeat what he described as Beijing's likely plan: a massive attack with little warning. It's a sound concept, and the CNAS work that fleshed it out this year is serious. Hellscape is built to break an amphibious assault at the water's edge.

Beijing is rehearsing something else. The PLA's Justice Mission 2025 drills in December, run alongside the China Coast Guard, simulated a blockade of Taiwan's main ports and control of the waterways that carry its energy imports. This year the China Coast Guard and Maritime Safety Administration have run what the Jamestown Foundation calls a "quasi-quarantine" east of the island, creating the appearance of administrative control without declaring a blockade. Taiwan has already prosecuted a Chinese captain for severing an undersea cable. Each step is a law enforcement action, an inspection, an accident. None of them is an invasion.

A drone swarm waiting in the Strait for a landing force has nothing to shoot at when the adversary is a coast guard cutter boarding a container ship for a "safety inspection." The first Taiwanese or American drone to fire makes Taipei the aggressor. So Beijing won't cross the Strait. It will tighten the noose: a quarantine, a severed cable, an insurance listing, a shipping line that quietly decides Kaohsiung isn't worth the premium. It will bank on the world's risk aversion. It’s already working. After the May summit in Beijing, Washington paused a record $14 billion arms package for Taiwan, and the President described those sales as a "very good negotiating chip". Taiwan will not be conquered. It will be persuaded, one closed option at a time, that there is nothing left to defend.

Answering below the threshold

You cannot deter gray zone coercion with a capability designed for the war the adversary is careful never to start. The answer has to live in the same band the attacker does: below the threshold of general war, above the threshold of pain. Three steps would help in the Black Sea, and each has a Pacific twin.

Presence that denies, not presence that watches. Turkey, Romania and Bulgaria already run a Mine Countermeasures Task Group whose mandate was widened in July to cover undersea infrastructure. Montreux restricts warships of non-Black Sea states, not the littoral navies. Widen the mandate once more, to counter-drone escort of merchant traffic through allied economic zones, and buy the equipment from the Ukrainians who have kept their own grain corridor open under fire. In the Pacific, the equivalent is a convoy and escort plan for a quarantine, not only a kill chain for an invasion.

Decide the response before the incident. The moment of decision is where risk aversion wins, because it is always easier to wait for one more forensic report. Allies should agree in advance, and say publicly, what a verified strike on shipping in their waters will cost Moscow: a pre-approved tranche of capability released to Ukraine, a pre-agreed number of shadow fleet hulls detained. Attribution should trigger an equivalent consequence, not another discussion. Taipei and Washington need the same menu for a quarantine, written now, while no one is under pressure.

Take the market off the adversary's side. When insurers and charterers do the attacker's work, governments need a sovereign war-risk backstop for vessels trading to allied ports, so the next listed-area extension doesn't function as a blockade by spreadsheet. Taiwan will need that backstop on the first day of a quarantine, not the ninetieth.

None of this is escalation. It is the minimum required to make the gray zone cost something.

The Thirteenth Mile

———

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Economic statecraft has become a primary instrument of US national security, deployed with a frequency and ambition that outpaces the intelligence architecture built to support it. For sanctions, tariffs, investment screening, export controls, and development finance to succeed, the United States must fully leverage the data and intelligence available to it. Now is the time for the IC to organize itself around the discipline of economic and financial intelligence.

The IC has long struggled to prove its value to economic customers: the Secretaries of Treasury, Commerce, Defense, and State, as well as the US Trade Representative and financial regulators. One frequent explanation is the IC’s historic orientation toward military and diplomatic support. Another is the perception that classified economic analysis lacks distinctive value. I spent most of a twenty-three-year intelligence career inside the economic discipline, ultimately leading Treasury’s Office of Intelligence and Analysis (OIA). While this may once have been true, the IC is doing better than ever to meet growing demand.

The problem is no longer the quality of the analysis—which has matured immensely—but the IC’s decentralized approach to serving its economic customers. No IC agency is specifically responsible for the discipline of economic and financial intelligence. The closest is OIA.

Congress created OIA in statute in 2004 with an eye toward sanctions support and countering terrorism finance. Its role has since expanded across economic, financial, and cyber issues for customers across government and industry. However, OIA is not the designated IC lead for US economic statecraft—no IC agency is. One consequence is that the Office of the Director of National Intelligence (ODNI) remains the statutory lead for analytic support to the Treasury-led Committee on Foreign Investment in the United States (CFIUS). That made sense in 2007, when the Foreign Investment and National Security Act codified CFIUS and assigned the Director of National Intelligence that role. At the time, OIA was in its infancy and consumed by counterterrorism. That is no longer the case.

The instinct in Washington is to solve a challenge like this by first creating a new organization, then fixing the functions. Congress should start with the functions instead, then address where the discipline sits. To improve IC support to economic statecraft, Congress must first act on six fronts.

Designate a functional manager. One IC element must own economic and financial intelligence as a discipline: collection priorities, analytic standards, a hiring and training pipeline, and a framework for systematic engagement with allies and industry. Nothing about that role requires a new agency.

Clarify authorities. Explicitly authorize collaboration between the designated lead and both its government customers and the private sector, including exchange of expertise and data.

Supercharge private sector engagement. Many of the best national security solutions in economics and finance will come from industry. Create a permanent path for its ideas, expertise, and capabilities.

Work with what exists. Use OIA as the foundation and keep the number of IC agencies flat, but cap its size so it stays nimble as economic statecraft evolves.

Revisit ODNI’s CFIUS role. IC support to CFIUS sits with ODNI because in 2007 no one else could carry it. Whether it should move depends on where the discipline lands, but Congress should not view the 2007 answer as permanent.

Fund it as a national mission. Economic intelligence should not have to compete for a share of a domestic department’s topline. Give the discipline a dedicated budget line, with the investment in people and AI that exploiting economic data at scale requires.

That leaves where the discipline sits—and there are three answers, not one.

The easiest first step is a designation: name OIA the functional manager, leave it in Treasury, and make clear in statute and to policy customers that OIA is the center of gravity for economic and financial intelligence. That is available now and beats the status quo. Nevertheless, an IC office answering to the Secretary of the Treasury will always be seen—correctly—as Treasury’s first. This is why Commerce and others periodically press for shops of their own, an outcome that grows the IC rather than optimizing it.

The achievable reform is bureau status. Treasury did this with FinCEN in 2002, and FinCEN is now treated as a government-wide and international resource rather than Treasury’s alone. Done properly it means a separate appropriation, a director accountable to both the Secretary and the DNI, and a statutory mission naming service to the whole government, the private sector, and our allies.

The stretch option is to elevate OIA to become an independent National Geo-Economic Intelligence Agency—still my own preference, because only independence settles the question of whose intelligence office it is. But where the discipline sits is the last decision, not the first. Under any of the three, the proximity OIA has built with Treasury policymakers is a design problem with a known solution: dedicated, co-located teams at each major customer department.

Economic intelligence is a core national security capability and should be organized and resourced like one: purpose-built to track, anticipate, and disrupt adversary financial and commercial threats in real time. The playbook has changed. Our competitors are more agile, emboldened, and shaping markets and supply chains to their advantage while we debate whether the threat qualifies as strategic.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. Government. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or endorsement of the author's views.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Over the last century, modern medicine achieved a historic feat. We increased the human lifespan by 33%. But at the same time, we completely failed to defend our brain healthspan. Today, a silent gap of 15 to 30 years exists between the time our bodies survive and the time our brains remain vibrant, innovative, and fully functional. It is a terrifying paradox. Medical science has advanced so much that a newborn today can realistically expect to live to 100, if not 120 years old. Yet, we passively accept that their cognitive engine will begin an irreversible, downhill slide in their thirties with the likelihood of dementia reaching almost 100% by the age of 110. What good is an extra three decades of biological existence if our brains lack the strength and resilience to enjoy it? This is no longer just a localized healthcare crisis; it is an imminent national security threat to our competitive edge.

Look at where our national focus and funding are directed. America is focused on investing billions of dollars into artificial intelligence and hypersonic defense systems. However, we are systematically ignoring the ultimate computing engine that builds the technology, commands our military, drives our economy, and stabilizes our communities: the human brain.

Our global competitors are not making this mistake. Most notably, China understands that future geopolitical dominance will not be won simply by hoarding raw technology. It will be won by the cognitive longevity, relentless innovation, and emotional resilience of their population. They are playing the long game and investing in their brain economy; We are falling behind.

In the military, we use a concept called staying "left of boom." It means executing proactive, aggressive conditioning and preventative strategies to stop a catastrophe before it happens, rather than digging through the wreckage after an explosion.

Right now, America’s approach to brain health is reactive. Our public policy treats brain aging as an inevitable, downhill slide into deficit. We pour billions of dollars into solving brain health collapse, like dementia and visible cognitive breakdown, before we actively intervene. But that approach is a losing strategy. We must shift from a reactive, disease-focused model to a proactive era of precision brain health in order to finally maximize American brainpower. If we do not actively optimize our collective intelligence and mental endurance, we will fall behind not only in defense readiness but also in scientific advancement and workforce productivity.

Fortunately, building a sharper, more resilient nation has never been easier or more measurable.

A landmark, three-year longitudinal study of 4,000 adults recently published in Nature Portfolio’s Scientific Reports completely dismantles the myth of inevitable cognitive decline. The data proves that the human brain possesses a no-ceiling capability. From ages 19 to 94, the brain retains a profound capacity to continually rewire, adapt, and improve its performance over time.

The key to unlocking this potential is a newly validated, multidimensional metric called the BrainHealth Index. For the first time, we can treat the brain exactly like physical fitness. We don't guess if our hearts are healthy; we measure blood pressure. The BrainHealth Index finally gives us a credible benchmark to track and measure holistic brain improvement across three critical pillars:

• Clarity: Our raw capacity to solve complex, novel problems and drive deep technological innovation.
• Connectedness: Our capacity for social purpose and communication, which serves as the bedrock for stable families and strong communities.
• Emotional Balance: The mental resilience required to perform under extreme pressure, from corporate boardrooms to tactical defense environments.

When we actively invest in and train our cognitive micro-skills, the positive implications ripple across society. Every day, citizens become better in their personal relationships, more productive at their jobs, and significantly more resilient against modern burnout and life stressors. Scaled nationally, this collective mental fitness becomes the invisible armor required for our national defense and technological endurance.

As a neurologist, a retired U.S. Army Colonel, and the former founding director of DARPA’s Biological Technologies Office, I have spent my entire career protecting and restoring the brains of our service members. I know what the human mind is capable of achieving when it is pushed to optimize, rather than just manage decline.

Our federal agencies, including the Department of Health and Human Services, the NIH, and the Department of Veterans Affairs, must immediately work to adopt scalable, digital health initiatives that democratize these brain optimization tools nationwide. But executive action is only half the battle. Congress must step up and introduce a unified, bipartisan National Brain Capital Act. Just as lawmakers realized we could not secure our future without a CHIPS and Science Act to defend our artificial intelligence hardware, they must recognize that we cannot protect our nation without a legislative framework to maximize our human brainpower. We must empower every single citizen with the self-agency to improve their own cognitive capacity. It is time for Congress to stop treating brain performance as a passive medical luxury for the few. It is a national imperative to keep America leading the world.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

A7’s OpenAI prompt was six words long: "Translate [name] to [language]. Answer only translated text."

Developer code leaked in 2025 from A7—the Kremlin-linked payment network designated by Treasury on October 1 as “a significant transnational criminal organization”—shows A7 used this prompt with OpenAI's API to create fake invoices, fake stamps, and a complex ledger that made Russian procurement look like ordinary trade.

Our investigative work, as featured originally in the “Big Shor” investigation and in subsequently featured in the New York Times and Financial Times, reveals that between January 2025 and June 2026, A7 laundered over $80 billion through the international financial system and continues to do so today. Zach was the principal researcher and Dawson peer reviewed the report and mentored the research team.

The common story is that sanctions cut Russia off from SWIFT and dollar clearing. In reality, Russia never left the Western financial system; A7 is how it re-entered at state scale. It still needs dollars and euros to buy components, sell oil, and pay intermediaries; China’s CIPS, yuan, crypto, and barter cannot replace them.

How the scheme works

A7 acts for Promsvyazbank, the state bank serving Russia's defense sector. A7 has laundered over $80 billion through roughly 435 financial institutions in at least 83 countries, funding Russia’s war in Ukraine, intelligence operations, election interference, and trade. Its clients have included Iranian oil sellers, which is why Treasury rolled the designation into Operation Economic Outcast.

A7’s shell companies, often run from Russia over VPNs, open accounts at local banks in Bishkek or Dubai’s free trade zones. Those banks rely on larger regional banks, which clear dollars through correspondents in New York or Hong Kong. Each sees only the customer in front of it. Card programs issued under sponsor banks give front companies and Russians access to payment rails without a direct banking relationship.

Fundamental to the scheme were fake invoices, produced at scale using OpenAI’s ChatGPT. A7 also used ChatGPT to forge stamps and automate intake of SWIFT payment confirmations from scanned receipts. Because A7 broke the operation into steps that each looked legitimate, OpenAI’s screening was unlikely to flag it—a gap AI companies must close.

This is where the burden falls on banks, and where the anti-money laundering (AML) framework fails. It was built to catch criminals hiding proceeds, not a state-backed service with intelligence-grade tradecraft. A7’s disposable shell companies are replaced faster than any sanctions list can be updated. To Western correspondent banks, its flows look like normal bilateral trade.

Banks can catch A7 only by tracking behavior over time: new free-zone trading companies moving outsized volumes, product descriptions that do not match the counterparty, and payment routes with no commercial logic. However, banks can only go so far on their own.

The deeper problem is permissive jurisdictions—UAE free zones, Hong Kong, Kyrgyzstan, and Türkiye—that offer fast incorporation, light ownership checks, and access to dollars and euros. Intermediating Russian trade is profitable, and many of these governments frame it as “neutrality” rather than evasion. In Kyrgyzstan, A7 relied on relationships reaching the highest levels of government and the banking sector.

The Macro Threat: Sanctions, SWIFT, and China

As former U.S. Treasury and intelligence officials, we see A7 as a sobering reminder that the first wave of financial sanctions on Russia fell short. The international banking system remains the indispensable engine of Russia’s war effort.

This exposes a broader geopolitical failure: adversary coordination. Russia, Iran, the DPRK, and China increasingly share intermediaries and methods to exploit Western finance rather than build their own. Yet the allied response remains fragmented, targeting networks like A7 one at a time.

This forces hard choices about dollar access. Washington could strip correspondent access from the Chinese and regional banks moving billions for U.S. adversaries. That might disrupt A7, but it raises the question of whether weaponizing dollar access compels compliance or accelerates Beijing and Moscow's push for a closed-loop financial system.

Changing the Equation: Government Actions

Allied governments must close systemic loopholes. Diplomacy with third countries has largely run its course; the leverage now lies in their banks’ access to Western finance. Tools like FinCEN’s Section 311 can force regional banks to choose between servicing networks like A7 and keeping their Western correspondent accounts. Regulators must treat nested correspondent relationships (banks clearing payments for other banks’ customers) and sponsored credit card programs (cards issued by smaller banks and fintechs under a bank’s license) as direct compliance liabilities.

Exams that test only static list-screening teach banks to build to that baseline. Exams should require network analysis, and governments should help scale these costly tools for vulnerable institutions in developing countries. This must be paired with mandatory information sharing: secure channels for client exit data and real-time international exchange of typologies.

Finally, authorities must treat AI and cloud infrastructure with the same scrutiny as traditional finance. Finalizing know-your-customer rules for cloud providers and requiring AI companies to flag behavioral anomalies would deny illicit actors the cheap infrastructure they need to scale.

A7 still moves billions every month. A week after Treasury acted, A7 announced a stablecoin USDT-SWIFT product; the timing was not a coincidence. Even if A7 is degraded, its model is highly portable, and Iran and North Korea are watching. The question for Washington, London, and Brussels is whether they can help industry disrupt these networks through a compliance culture that prioritizes real impact over list-based box-checking.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Earlier this month, Sky News correspondent Alex Crawford got a notice from X: her account was being blocked in Turkey. She asked the Turkish presidency why and has yet to get an answer. She isn’t the only one.

Crawford is one of at least 1,270 accounts Turkish courts ordered X to block in September. X made roughly 90% of them unavailable in Turkey, according to the Freedom of Expression Association. Weeks before X began blocking these accounts in Turkey, Elon Musk declared that “any censorship required by governments is now clearly visible.”

While American social media platforms show clear outrage when they are banned in other countries, they rarely show the same outrage when Turkey silences its citizens online. These bans and blocks disproportionately hit marginalized communities, particularly those who rely on these platforms to organize, share information, and make their experiences visible. These restrictions reduce the visibility of minority perspectives and encourage self-censorship among LGBTQ+ people, activists, and independent journalists. A democracy depends on people being able to access information, express their views, and participate in public debate. When certain communities are systematically pushed out of these spaces, their experiences and perspectives become less visible in the broader political conversation.

The Crackdown Behind the Blocks

Since the failed 2016 coup attempt in Turkey, the government has steadily expanded its control over the information environment, including by targeting journalists, media organizations, and political opponents who criticize the government. According to Reporters Without Borders (RSF), roughly 90% of Turkey’s traditional media is currently under government control. As a result, many journalists have turned to YouTube and social media to reach audiences independently of traditional outlets. These platforms, however, have also become subject to government pressure, including licensing requirements, arrest threats, and content restrictions.

The scale of these restrictions was particularly visible following the arrest of Istanbul Mayor Ekrem İmamoğlu. Between March 19 and April 12, 2025, X blocked access in Turkey to at least 471 accounts with a combined 17.2 million followers. The affected accounts ranged from journalists with more than 1.2 million followers to grassroots organizations with fewer than ten. At least 22 of the blocked accounts belonged to women’s rights organizations, including the We Will Stop Femicides Platform, which had approximately 181,000 followers. The breadth of the restrictions suggests that online censorship in Turkey has affected not only prominent journalists but also smaller civil-society and activist organizations.

Similar restrictions were reported in September 2026 during the government’s “My Family Is Safe” operation targeting LGBTQ+ organizations. On September 13, access to 32 X accounts—many belonging to university LGBTQ+ groups—was blocked in Turkey. Three days later, an Istanbul court ordered access restrictions on another 419 accounts over allegations that they had shared “obscene content.” The accounts reportedly included journalists, activists, media organizations, and women’s rights groups. The restrictions also affected the accounts of Evrensel newspaper, Amnesty International Turkey, and the Media and Law Studies Association (MLSA). Moreover, the website and social media accounts of the news organization T24 were blocked over content authorities characterized as “LGBT propaganda.”

When American Platforms Do Ankara’s Work

The role of social media companies is particularly significant because many of these restrictions depend on platforms complying with requests from Turkish authorities. Transparency reports show high compliance with government requests: TikTok (91.8%), X (85.66%), Instagram (79.15%), Google (77.5%), and Facebook (42%). These rates illustrate that restrictions on online speech do not result solely from direct government censorship. When platforms carry out blocking orders without challenge, government censorship reaches the spaces where journalists and activists work independently. The result is a chilling effect: people who have not been blocked censor themselves, and citizens lose access to information they need to take part in public life.

X says it challenges the orders in court and that refusing risks throttling the entire platform in Turkey. But when a court ordered İmamoglu’s campaign account blocked in August, X implemented the block while contesting it. The damage also reaches Americans: the accounts blocked include U.S.-based @Gayety and @Pride.

The hypocrisy is hard to miss. X has long portrayed itself as a defender of free speech, and American officials and tech executives have spent years warning about foreign censorship. Yet when a NATO ally demands that dissidents be erased, American companies behave like compliance departments.

The Silence After the Block

The impact of censorship extends beyond the accounts that are formally blocked. It can also affect people who remain free to post but choose not to do so. Journalists, activists, academics, and ordinary users may engage in self-censorship because they fear arrest, legal consequences, harassment, or repercussions for people associated with them. Self-censorship occurs when individuals possess information or opinions they would otherwise share but deliberately withhold them because they perceive a risk in speaking publicly. In this sense, censorship can operate indirectly: the possibility of punishment may be enough to silence speech even when no account has been formally restricted.

However, this self-censorship has consequences. Activists in Turkey use online platforms to raise awareness about violence, sexual assault, and killings targeting marginalized groups. For communities whose perspectives receive limited attention in traditional media, social media can provide an important space to document abuse, organize campaigns, and reach audiences both inside and outside the country. Yet while people continue to rely on these platforms for information, they must also navigate the risks associated with speaking publicly online.

This creates a broader chilling effect on public discussion. When websites are blocked or activists are arrested, others may become less willing to publish, share, or amplify information about marginalized communities. The result is not simply the removal of individual accounts or pieces of content; it can also reduce the amount of information available to the public about abuses affecting vulnerable groups. For communities that depend on outside attention and advocacy, these restrictions may also make it more difficult to reach international audiences and build cross-border support.

Online censorship in Turkey is expanding, and it falls especially hard on marginalized groups. Turkey still holds elections, but democracy depends on more than voting: when journalists, activists and opposition figures are blocked from the platforms where public debate happens, the choice voters make is less informed and less free. Those platforms are American, and so is a share of the responsibility.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The United States is racing to field AI and autonomous systems. It is not racing to figure out how to fight with them. This imbalance between technology and concepts is widening a gap the U.S. is ill prepared to close. Ukraine has shown us why this gap is a threat: every new capability breeds a countermeasure, and technological advantage now spoils in months. The answer is not just faster innovation. It is making concept development a continuous military function, one that ties new technology to experimentation, validation, and adoption at the speed the fight demands. Not just a function of schoolhouses and Headquarters.

Russia’s full-scale invasion of Ukraine began in 2022 as a war of armored columns and maneuver. Today, trenches and minefields stretch for hundreds of miles, reminiscent of World War I; while drones, unmanned ground vehicles, precision munitions, and persistent surveillance hunt anything that moves.

The United States has poured considerable energy into buying and fielding new technologies faster, and has shown how we are endeavoring to learn from Ukraine. But the U.S. has put far less energy into the institutional processes we need to determine how we fight as technology and adversary behavior changes. This creates a consequential gap between what we build and how we fight.

This growing gap has two parts. The first is substance: technology and concepts need each other. A concept that ignores new technology will overlook new operational possibilities, while a new technology without a concept is a demonstration… not a warfighting capability.

The second is tempo: technology moves in weeks and months, while the processes that decide how formations should use it operate in years. Our fastest-ever concept cycle, from counterinsurgency doctrine to the Iraq Surge, took eighteen months. Most move slower still: gradual, methodical, and caked in decades of calcified bureaucracy.

The problem isn’t just that doctrine changes more slowly than technology. Units in combat adapt fast. The greater challenge is translating those adaptations into concepts that can be tested, refined, integrated into combined-arms operations, and adopted across the force.

That doesn’t mean rewriting concepts every time a new drone appears. It means recognizing when a change in technology (or in the enemy) breaks assumptions behind how we fight, then testing and spreading the fix before it goes stale.

Concept development must become a continuous military function, not a periodic publication. The winner won’t be the side that buys technology fastest, but the side that turns it into battlefield advantage before the enemy adapts. Today, the U.S. is not built to do that quickly.

Ukraine: Adaptation as Necessity

Ukraine illustrates the increasingly reciprocal nature of battlefield adaptation. To date, every advantage has invited an answer. Both sides have changed their technology and tactics again and again in response to each other, and neither has held an edge for long.

Consider the first-person-view (FPV) drone. Cheap, attritable, and easy to build, FPVs turned every squad into a precision strike force. Electronic jamming became its counterpoint. Fiber-optic drones, immune to jamming, then entered the field. Each move created new openings and new limits, and forced changes in both the technology and how it was used.

The operational consequences extend well beyond FPV drones. Persistent surveillance paired with cheap precision strike has changed where and how formations can move, mass, resupply, and survive. Concealment, dispersion, and deception matter more than ever. A unit that concentrates in a location, moves in the open, or runs a predictable supply route becomes a target.

This is the more consequential lesson from Ukraine: a technological innovation may initially improve the effectiveness of a particular weapon or unit, but its broader significance emerges when it changes the conditions under which formations operate. Then the enemy adapts, and the cycle starts again. And again.

In Ukraine, technological advantage is perishable. The hard part isn’t fielding new capabilities. It’s recognizing when they, or the enemy’s countermeasures, demand a different way of fighting.

The American Challenge: From Innovation to Institutional Learning

For the United States, Ukraine demonstrates why concept development cannot remain an episodic activity conducted in schoolhouses and periodically revisited. The lesson is not that Ukrainian solutions are universally applicable. It’s that new technology and countermeasures can break operational assumptions faster than our institutions are built to respond.

The United States cannot just replicate Ukraine’s approach. U.S. forces fight expeditionary campaigns, integrate across joint and coalition formations, and answer to policy, legal, and safety requirements that a nation like Ukraine, fighting for its survival and territorial integrity, does not. The goal is Ukraine’s capacity to adapt, built to American requirements.

Our gap isn’t a shortage of experiments or innovation offices; efforts like the Army’s “Transformation in Contact” are putting new capabilities into units and learning from them. Our gap is having a pathway from what one unit learns, to what the whole force learns. A concept that works in one brigade may fail against a different enemy, in different terrain, or at a higher echelon. And a successful experiment rarely changes training, force design, or acquisition on its own.

Autonomy has raised the stakes and made our pathway to institutional learning an even greater necessity. A software update, a retrained model, or a new way of employing a system can change how technology behaves, and can quietly invalidate the conditions under which it was tested and fielded.

That is the problem assured autonomy is meant to solve. Assured autonomy is justified confidence that an autonomous system will do what it is supposed to do. It must therefore account for the whole relationship: the technology, how it is employed, and the environment it operates in. Continuous, evidence-based assessments can tell commanders when a change requires fresh evaluation and where the boundaries of responsible use lie. Built into the adaptation process, assurance can support speed without abandoning safety, reliability, accountability, or established approval authorities.

Building an Adaptive Concept-Development Enterprise

The United States needs a repeatable process that links new technology, operational concepts, experimentation against a thinking enemy, validation, and adoption across the force.

We are suggesting neither a prototype nor a concept paper. It’s a validated, revisable concept of employment, backed by operational evidence: how a formation can fight differently, under what conditions that works, and what it takes to make it happen. Four functions are needed to get us there:

First, connect concept and technology development directly to operational formations.

Operators, technologists, testers, and concept developers should work alongside commanders. Their job goes beyond improving systems or inventing tactics: they should identify which operational assumptions a new capability breaks, and draft concepts to test.

Not every improvement demands a new concept. A better jammer may only need a new tactic; a capability that changes how a brigade moves, masses, or resupplies demands a new way of fighting. The force needs people close enough to the fight to tell the difference.

In Ukraine, operational units have designated innovation officers liaising directly with industry; industry partners provide prototypes, receive feedback on battlefield experimentation and adaptation. Through this relationship, operators, technologists, and testers converge on a specific requirement, and battalion-level Commanders have the authority to acquire the necessary prototypes to integrate into their formations.

Second, establish a persistent cycle of adversarial operational experimentation.

The question isn’t whether the technology works as designed. It’s whether the formation using it accomplishes the mission better against an opponent who adapts. Experiments should also find where a concept fails: what works against one threat may fail against another, and a promising system may impose unacceptable costs elsewhere in the formation.

Combat training centers, experimentation units, and operational formations already provide the foundation. The task is to link them into a persistent learning loop, fed by operational evidence and intelligence.

Ukraine offers a cautionary tale. For nearly three years, intelligence indicated Russia was developing jet-powered Shahed variants, by most accounts ample time to prepare countermeasures. But when Russia began launching these faster one-way attack systems, Ukraine had too few interceptors capable of that speed, and their previous interception tactics were insufficient to stop them. The warning did not sufficiently feed a cycle of experimentation before the threat was fielded. That gap cost lives.

Third, connect operational validation to adaptive fielding.

Today, a system is typically tested, approved, and fielded as a finished product. But in a fight like Ukraine’s, nothing stays finished: software is updated, models are retrained, and units find new ways to employ what they have. Each change can quietly invalidate the evidence behind the original fielding decision. Adaptive fielding treats validation as continuous, asking what has changed and whether the earlier evidence still holds.

For autonomous systems, this is where assured autonomy matters most, and where scrutiny should match the modification. A minor software patch for a drone flying the same mission in the same conditions may need only a quick check. Retraining its targeting model, sending it into a new environment, or reducing human supervision demands full re-evaluation. This doesn’t bypass approval authorities or testing requirements. It gives them a faster, evidence-based way to decide when more evaluation is needed.

Fourth, institutionalize validated concepts across the force.

This is the decisive step. Experimentation produces evidence; learning happens only when that evidence changes how the force trains, organizes, equips, and fights.

A counter-drone tactic proven in one division should appear in the next combat training center rotation, the next force design update, and the next acquisition…not in an after-action report on a shelf.

This change requires a defined pathway and clear authorities. Commanders, testers, capability developers, and acquisition officials each own different decisions, but those decisions must draw on a common body of operational evidence, with clear decision points for when the evidence is strong enough to act. The result is a continuous cycle: develop, experiment, validate, field, learn, institutionalize, adapt. Then repeat, as the technology and the enemy change.

In Ukraine, Aerorozvidka, a non-governmental organization, plays this role: not a think tank but an empowered change agent -- capturing evidence from the field and shepherding it through commanders, technologists, and acquisition officials until new tech is deployed or new concepts (like deep strike) are fielded.

Operational Advantage Depends on the Capacity to Learn

The United States possesses substantial technological, industrial, and innovative capacity to compete in AI and autonomous warfare. But technological leadership alone will not produce operational advantage. Adapting a system isn’t the same as adapting a force, and a better-performing unit doesn’t change the course of a campaign.

Four questions will dictate our capacity to learn: The technical question is what a system can do. The tactical question is how formations should employ it. The operational question is how it changes the way maneuver, fires, intelligence, protection, sustainment, and command combine to win. The strategic question is whether the institution can answer all three, again and again, faster than the enemy.

The race isn’t to build the best autonomous systems or to field them first. It’s to turn technological change into operational advantage, faster than the enemy can take it away. In the age of AI and autonomy, the force that learns fastest wins.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Every October, Cybersecurity Awareness Month puts practical security measures in the spotlight. Can an employee recognize a phishing email? Will someone pause before clicking a suspicious link? Are passwords and access credentials being protected? These are important questions; individual behaviors are crucial to maintaining cybersecurity.

But awareness is so laser focused on preventing and mitigating the malicious cyberattack, it’s easy to lose sight of the bigger picture: the cyberattack in front of you may be only one piece of the threat.

In the era of hybrid threats, a cyberattack could be part of a broader campaign in which digital activity intersects with cognitive warfare, sabotage, unusual drone activity, disruptions to communications and navigation systems, and much more. State and state-linked networks might use online fraud or scams to generate revenue for operations, launder funds and undermine confidence in financial and/or government institutions.

The challenge for security and law enforcement agencies transcends detecting and responding to one cyber incident at a time. They must also determine whether events that appear separate may be connected.

That distinction changes what it means to be aware, and the urgency is intensifying. Recent research and reporting shows Russian cyber activity directed at European targets is likely intended to enable intelligence collection, operational reach and long-term access rather than immediate disruption. In parallel, the Iranian government is believed to be relying on a longstanding hybrid warfare model combining cyber operations, asymmetric military operations, information warfare, proxy attacks and coercive state activity, with AI increasingly acting as a force multiplier.

Expect to see more of this going forward, not less.

CONNECTING THE DOTS

Consider the signals individually: a government agency experiences a cyberattack. Unusual drone activity is reported over critical infrastructure. GPS service is disrupted. False or misleading information is deliberately spread. Viewed on their own, these events may have different causes, and each can appear to be a separate incident.

Yet hybrid campaigns often depend on individual activities initially looking ambiguous or unrelated. If each signal is treated only as a self-contained incident, relevant connections may be missed – and when the connections are missed, so is the broader pattern they could form.

This does not make traditional cybersecurity awareness less important. It makes awareness more demanding. The familiar focus on individual judgment must be matched by institutional awareness: the ability of government agencies, armed forces, critical infrastructure operators, and other relevant organizations to recognize which signals may matter beyond the immediate event.

That begins before advanced analysis enters the picture. An organization cannot share information it did not capture, and it cannot capture information it did not recognize as potentially relevant. The first requirement is therefore a common understanding of what may be security-relevant and what information is needed to contribute to a broader situational picture.

This shift is central to the awareness challenge. A suspicious link has a clear place in the traditional conversation. A weak signal in a hybrid environment may not have the same clarity. Its significance may emerge only when it is considered alongside other information. Awareness, in this context, means looking beyond the apparent boundaries of a single incident without assuming that any one event tells the entire story.

The sequence matters: recognize, capture, share, assess. If a potentially relevant signal drops out at any stage, it cannot inform the larger picture. If it moves through that sequence, it becomes one piece of information that can be examined in relation to others.

The next task is to bring those fragmented pieces together. Threat intelligence, decision intelligence and artificial intelligence can help teams work across large volumes of data, correlate information, reveal connections, and alert analysts to anomalies. Their value is especially clear when no single signal is decisive. Several weak and seemingly unrelated signals may form a pattern that supports a more informed assessment of the security situation.

The point is not simply to accumulate more data. It is to make relevant information usable as part of a coherent view. A list of isolated incidents still leaves decision-makers looking at fragments. A situational picture asks a different set of questions: What may connect these events? What does the combined pattern suggest? Which developments deserve closer attention? And what might happen next?

That last question is essential. The goal is not limited to identifying a cyberattack or another security-relevant event after it occurs. It is to understand the relationships among relevant signals well enough to identify potential future developments at an early stage. Detection remains necessary, but detection without connection can leave the larger threat out of view.

For Cybersecurity Awareness Month, this broader perspective offers a useful way to expand the conversation. At the individual level, awareness still means recognizing the suspicious email, protecting credentials, avoiding scams and frauds and thinking before clicking. At the national level, it also means making sure the right organizations know what to notice, what to record, what to share, and how to place that information in context.

The difference is one of scale. An individual may be watching for a malicious link. Government agencies, armed forces, critical infrastructure operators, and other relevant organizations must also be watching for relationships among cyber activity, disinformation, sabotage, drone activity and communications interference.

That is the blind spot Cybersecurity Awareness Month should help bring into focus. There’s more to awareness than paying attention before clicking a link. Awareness means we know which signals deserve attention, whether we can bring them together, and whether we can see the threat they may form before the pattern becomes unmistakable.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Here is a number worth sitting with: federal teams seized roughly 700 drones around World Cup venues this summer. Seven hundred — at one tournament, in one season, with the best-resourced counter-drone units in the world on the field. That figure is a success story and a warning in the same breath: the threat volume is enormous, and the federal government cannot be the only team suiting up for it.

Until this year, it legally had to be. The power to disable a hostile drone belonged to a short list of federal agencies, which left a state trooper at a stadium gate or a corrections captain watching an aircraft hover over his yard with nothing but binoculars and a report form. Congress ended that with the SAFER SKIES Act in December's defense bill, and the DHS-Justice framework implementing it has been in force since July 1: state, local, tribal, and territorial police and corrections agencies that complete federal training and certification, on approved equipment, can now track a threatening drone and — against a credible threat — take it out of the sky above major venues, critical infrastructure, and prisons.

And in the past week, Washington has shown it means to deliver. The Justice Department announced that the FBI's counter-drone training center in Huntsville will double its capacity. DHS's Science and Technology Directorate put commercial counter-drone systems through operational testing alongside state and local officers. The Pentagon selected four directed-energy systems for a homeland counter-drone pilot. This is what implementation momentum looks like, and the departments deserve real credit for it.

Now the hard truth: doubling a small number produces a small number. The Huntsville center's first class, last fall, held twelve officers, and it remains the only place in America where a state or local officer can earn the legal right to bring down a drone. More than 18,500 agencies are now eligible for these authorities. Against that denominator, even a doubled schoolhouse leaves the vast majority of American communities exactly where they were — watching — while the Super Bowl arrives in four months and the Los Angeles Olympics in under two years. Our prisons cannot wait either: drone incidents at federal correctional facilities rose twentyfold in six years, and state systems from South Carolina to Georgia are logging airborne contraband runs by the hundreds.

What turns momentum into coverage is money, sustained past the current news cycle. Congress should fund training at the scale of the authority it created: regional and satellite course delivery so a deputy in Phoenix is not waiting on a classroom seat in Alabama, instructor pipelines that multiply the schoolhouse instead of merely enlarging it, and a certification target tied to the event calendar that oversight committees actually track. Just as important, the FEMA counter-UAS grant program — $500 million across 2026 and 2027, built around the World Cup — should not sunset with the tournament that inspired it. The threat is not leaving when the fans do.

Governors have their own homework, and fewer excuses than ever: the grant rules push at least 97 percent of awarded funds down to local and tribal agencies within 45 days. The money is designed to reach the street. States should name a lead agency, compete for those dollars this cycle, and put their corrections systems and stadium districts first in line for certified teams.

Over more than twenty years in federal homeland security — the last of them leading U.S. Immigration and Customs Enforcement — I watched threats outrun statutes again and again. This time the statute arrived first, and this past week proved the executive branch intends to use it. The remaining question belongs to Congress and fifty governors: whether a nation that just confiscated 700 drones at a single sporting event will fund protection for everyone else. Authority without capacity is a promise. Appropriations are how promises get kept.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

“We never fight alone. We've never done that. You can go all the way back to the days of Revolutionary War. The United States has never gone into conflict on its own. We've always built coalitions. We've always involved partners and allies. And we'll continue to do so going forward.”

That was Gen. Ronald P. Clark, Commanding General, U.S. Army Pacific Command, speaking last Tuesday at a contemporary military forum, Decisive Landpower -- Deterrence and Partner Integration Against the Pacing Threat, as part of the 2026 Association of the United States Army (AUSA) Conference in Washington, D.C.

On the panel with Clark was Army Gen. Xavier T. Brunson, Commander, United Nations Command, U.S. Forces Korea, and Tara Murphy Dougherty, Chief Executive Officer of Air, a leading AI software firm that specializes in national security readiness.

The two Army generals spent a good deal of their time talking about lessons learned from Ukraine and the benefits to the U.S. of allies – specifically in the Pacific. That struck me as something to further explore, since one day later, on Wednesday, President Trump continued his running criticism of allies with an October 14, Truth Social screed.

Trump said in part: “Because of the fact that we have had such Military Success, we no longer ‘need,’ or desire, the NATO Countries’ assistance — WE NEVER DID! Likewise, Japan, Australia, or South Korea. In fact, speaking as President of the United States of America, by far the Most Powerful Country Anywhere in the World, WE DO NOT NEED THE HELP OF ANYONE! Thank you for your attention to this matter. President DONALD J. TRUMP.”

On the other hand, Gen. Brunson had told the AUSA audience one day earlier, “Everything that we do is intricately woven around the ROK (Republic of Korea)-U.S. alliance. That alliance has stood for some 75 years and it is an example or a paragon, if you will, of all that's right when folk work in alliance together. The problems that we solve are joint problems. They're not just U.S. problems. They're not just Republic of Korea problems. What they are is great opportunities for two nations to work in concert with one another in order to arrive at solutions that are beneficial for both countries.”

Gen. Clark explained further, “So our ability to be able to work with partners and allies on their sovereign soil, to be able to share procedures that we build through [military] exercises over the course of a year, some joint, some army-to-army, but always integrated with our partners. It gives us the opportunity to have our systems work technically, to have our procedures nested, and to get to know one another in a way that allows us to build the trust that's necessary in training. Because if we wait until crisis or conflict, it's too late to ask the question, can I trust

you? But because we've been working together, because we've exercised at scale, because we're modernizing our forces alongside one another, it works.”

Clark added, “We've really worked hard at building those relationships at scale inside of the land forces. We have a land forces dialogue that meets multiple times a year -- chiefs of army of Australia, Japan, the Philippines, and the U.S. We've invited the ROKs in, we've invited India in, and it continues to grow. So those relationships built army-to-army are what allows us to really integrate across interoperability, and integrate it really across our formations and with our partners in all.”

Brunson described how he and Korean Gen. Kim Sung-min, Deputy Commander of the U.S.-ROK Combined Forces Command, discussed training differently “taking advantage of the knowledge that we have of the threats that exist or that prevail in the Ukraine fight.”

Brunson said, “We talk about how we would operate in a distributed fashion…Just imagine if we trained across the entirety of the [Korean] Peninsula and got ourselves in a shape where we would say you can't utilize the things that you've learned in the fight in the battlefield in Ukraine on us, because we learned the same lessons and we've distributed ourselves in such a way that we don't make ourselves the target. We won't be moored in place.”

Clark talked about Russia, North Korea and China “learning from watching us partner, but the partnerships that our adversaries have built are transactional versus the transformational relationships that we build as a security partner of choice globally…for us it's really transformational relationships that we look to cultivate with partners and allies over time.”

Brunson described how the North Koreans, fighting for the Russians in Ukraine were “able to test systems there…and then bring that back home. So, in one aspect, they've shortened their RDT&E cycle.” He also pointed out, “The fact that you have a combat trained force with recent

combat on the [Korean] Peninsula for the first time since 1953..[and] are now bringing those lessons learned back into their own training cycle, it's shortened their time to develop them.”

Clark said that U.S. forces had also learned from Ukraine about the need for mobility and camouflage, which he described as “age-old army forgotten sciences of how to hide in plain sight and how to camouflage ourselves from observation...Our ability to be able to use electronic warfare, to be able to use just good, old-fashioned camouflage and the ability to deceive our adversary is a must. In those two theaters [Ukraine and Iran] it's not a near-peer adversary that we would be working against -- whereas, in our theater [the Pacific] it absolutely is.”

For Clark, the questions were: “How do we fight, you know, Type One, Type Two UAS [unmanned aerial system, drones]; how do we think through ballistic missile defense holistically in the region. We spend a lot of time working again with the joint force for solutions associated with that. How do we maneuver?”

Brunson raised a new issue by pointing out that, “Our old system was something [a weapons system] breaks, we send it all the way back CONUS [Continental U.S.] in order to fix it so we can then bring it all the way back out again.” That used to take 29 days by ship.

However, he added, “In the ally that we have in Korea we have a an absolutely premier industrial base, if you look at the Korea defense industry, some of the kit that we're producing right now sits along our friends, allies and partners.” Brunson said, “The Army’s new infantry squad vehicle (ISV), for example, is produced by GM Defense and GM Defense is also in the Republic of Korea.”

“So the idea of a regional sustainment hub would simply be…to bring those means of production to the theater,” Brunson suggested, noting, “In the maritime domain, when we look at maintenance, repair, and overhaul, which is being done forward alongside the Koreans, you know that 15 percent of global ship building is done in Korea. And, oh by the way, we've got an ally with a mutual defense treaty in Japan that has 10% of global ship building. And if we take these cases forward, we're able to stay in theater longer.”

The answer, Brunson said, “We've got to try to achieve admirable endurance in theater by partnering alongside our allies, seeing the things that they can do better than we can right now at distance and then keeping them right where they belong. That keeps our [military] forces forward.”

Dougherty chipped in saying: “Tens of millions of dollars saved by simply identifying things like unfilled requisitions or parts that are obsolete that can be replaced with something not obsolete and also less expensive. I think that this is it. This is part of how you generate lethality. You get readiness to pay for itself, because otherwise sustainment is too expensive when it has to be done for the entirety of the joint force all the way on the other side of the world.”

At one point, Clark said, “The secret sauce for us as an Army is our Non-Commissioned Officer (NCO) corps, reflecting Defense Secretary Pete Hegseth’s September 30 speech praising the same group.

Clark noted that both he and Brunson were sons of NCOs, and that “with the assistance of our senior non-commissioned officers, senior enlisted leaders across the [PACOM] region have embarked upon conducting assessments with our partners and developing strategies to help them build their NCO development programs inside of their formations.”

To illustrate his point, Clark said his units had just finished an assessment in Cambodia of its army and the Commander, Gen. Mao Sophan, “basically said, ‘Hey, whatever you're asking us to do, we're going to do it because we want to get to a level of proficiency with our Non-Commissioned Officer core that we see in yours.’"

I must point out that during the one-hour-and-thirty-minute session neither General -- Clark nor Brunson -- came near to mentioning President Trump’s repeated critical views about U.S. allies.

The closest anyone came was Dougherty, who at one point said diplomatically, “We'll head into midterm elections here [in the U.S.] in November, obviously as you know, and I think we expect some variation in the political dynamic in the United States, and our allies and partners all navigate their own political changes as well.”

She then added, “If you look over the course of history, however, at least modern history, certainly the United States has invested in those partnerships. And today, we still are -- maybe with a different flavor or a different attitude. And that's not really for me to say. I'm simply observing. But we haven't lost sight of the importance of allies and partners to securing U.S. national interests.”

I would bet Clark and Brunson – along with most U.S. military professionals – would silently agree with her statement.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Picture an intelligent analyst's screen. Data about troop movements, a port closure, a terrorist attack, or a weapons transfer sits at the center of a clean interface, with a confidence indicator glowing green. Two hundred outlets are carrying it, and the platform has counted every one. It looks like a corroboration. In many cases, it is a single Telegram post, copied, translated, summarized, and republished until its origin disappeared behind its own echo.

Nobody must be negligent for this to happen. It is what you get when a product or platform is built to measure volume and the user is tempted to read volume as truth.

I say this as someone who works with open-source material and believes in it. Commercial imagery, ship-tracking data, procurement records, leaked databases, and social media have changed what is knowable about conflicts and illicit networks; but the market that has grown up around these sources is selling something different from the discipline that makes them valuable, and governments and companies are buying it without noticing the difference.

A Crowded Market and a Thin Product

Open-source intelligence platforms are multiplying quickly. Walk through the company stands at any security conference and you will find dozens of them, each promising to fuse, monitor, and surface threats across the open internet, now almost always with an AI layer that summarizes, ranks, and alerts.

Strip away the interface and most of them offer little that a competent analyst couldn't already do with a search engine, a handful of specialist tools, and some patience. Reverse image searching, scraping social platforms, pulling corporate registry data, and geolocating an image are all learnable skills, and many of the best practitioners picked them up in public, often as volunteers. What the platforms add is convenience and scale, which is genuinely useful, but convenience is not analysis. The real product, in most cases, is the dashboard.

Dashboards are persuasive by design. They squeeze a messy information environment into something that looks like a picture of the world, with counts, trend lines, heat maps, and sentiment scores. Each of those findings implies that someone has already done the hard work of deciding what matters and what is true. Usually, no one has. The system has counted things, and counting is the easy part.

Counting Sources Is Not Testing Them

The core flaw is in what these systems reward. They tend to measure the number of sources behind a claim, not the independence of those sources. The two are very different things.

Independence is the foundation of corroboration. Two witnesses who saw an event separately make a claim stronger. Two witnesses who heard about it from the same third person do not. The same logic applies to reporting. A claim that traces back to a single channel but appears in two hundred outlets has one source and two hundred echoes.

Intelligence tradecraft has a name for this: circular reporting. It is among the oldest and best-documented ways analysts go wrong. The failures that most damaged the credibility of Western intelligence in the past generation involved, among other things, uncorroborated claims that were repeated, cross-referenced, and eventually treated as established because they seemed to come from many places. The lesson drawn at the time was that provenance matters more than prevalence. An aggregator that treats prevalence as confirmation is rebuilding the vulnerability that analysts spent years learning to guard against.

AI makes this problem fourfold. First, language models summarize and synthesize, and in doing so they take away the provenance trail that an analyst needs. A fluent paragraph that blends fifteen sources does not tell you that twelve of them are derivative. Second, the cost of generating plausible content has collapsed. Fabricated articles, cloned news sites, and coordinated amplification networks can now create the appearance of breadth cheaply, which is exactly the signal these platforms are built to count. Third, as more web content is produced or recycled by automated systems, the pool that analytics tools draw from becomes more self-referential. The echo chamber is increasingly populated by machines quoting each other. Lastly, AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. The danger is therefore not simply that an analyst receives false information, but that the uncertainty surrounding otherwise legitimate information becomes less visible.

None of this means the technology is useless. Entity extraction, translation, deduplication, and pattern detection across large data sets are real contributions. But the same tools that can help trace a claim to its origin are too often deployed to certify it instead.

Information Is Not Intelligence

The deeper problem is what happens after the dashboard produces its output. Companies market it as intelligence, and buyers, including government agencies, intelligence firms, financial institutions, and corporate security teams, purchase it as intelligence, then act on it.

However, open-source material is raw information. It becomes intelligence only after a process that no interface can fully automate. Someone has to establish where the material came from, grade how reliable the source has been, assess how credible the specific claim is, and test it against other collection. Established standards exist for this. Grading systems that rate source reliability separately from information credibility have been used for decades, and analytic standards require analysts to describe the quality and credibility of their sources, to distinguish between underlying evidence and judgment, and to account for alternative explanations. These are not bureaucratic formalities. They are the mechanism by which an organization knows how much weight a conclusion can bear.

When that step is skipped, the result is aggregated internet content with a confident interface. The output reads like a finished product, but the epistemic work behind it is missing, and the person reading it often can't see that. A decisionmaker shown a green indicator does not know whether it reflects three independent confirmations or one rumor with good distribution.

The consequences are practical. A government that bases sanctions designations, force posture, or diplomatic messaging on an unverified claim risks embarrassment at best and escalation at worst. A company that reroutes shipments or exits a market because a risk platform flagged a rumor can lose real money; and an agency that comes to rely on commercial feeds may quietly stop investing in the capabilities that would let it check them.

What Should Change

I would offer the following two principles.

One, to treat provenance and independence as essential to intelligence. Open-source material should be treated as a cue and a corroborator, not a conclusion. Open sources are at their best when they point collection in a useful direction or when they test and strengthen what other sources have suggested. A satellite image that shows construction at a site tells analysts where to look and what to ask. A procurement database entry might confirm a pattern already suspected. Neither is a finding on its own. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide. As AI makes it easier to summarize, reproduce and generate information, analysts need to know not only what a source says, but where the information originated and whether apparently separate sources are actually independent. A fluent paragraph that blends fifteen sources does not tell an analyst that twelve of them are derivative. Likewise, a cluster of articles, websites or database entries may create the appearance of broad corroboration while ultimately tracing back to a single underlying claim. Platforms should therefore preserve provenance wherever possible and make the distinction between original reporting, derivative content and AI-generated material visible to the user. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide.

Two, protect human assessment and the collection that supports it. AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. Human analysts therefore need both the time and the authority to question what automated systems produce rather than simply validate it. That also means protecting the collection capabilities that AI cannot replace. As open-source material becomes more abundant, the value of what cannot be found online rises. Human sources, financial intelligence, law enforcement access and legal process take years to cultivate and moments to lose. A budget cycle that trims them in favor of subscriptions is trading durable capability for a license that expires. The objective should not be to remove automation from intelligence work, but to ensure that automation remains subordinate to collection, verification and human judgment.

What Open Sources Cannot Close

I learned the limits of open-source work firsthand while researching foreign components in Russian strike drones. Open sources got me a long way. Recovered wreckage data, teardown imagery, part markings, and manufacturer documentation could establish what was inside these systems and who made it. That is valuable, and it was achievable by skilled analysts working in public.

But the questions that mattered most were different. Who actually bought a given part? Through which intermediaries did it move? Who paid for it, and through which accounts? Those gaps could not be closed by any amount of scraping. They required the tools that sit behind a legal threshold or inside a trusted relationship: law enforcement access to shipping and customs records, financial intelligence on transactions, and human sources with knowledge of how the networks operate. A dashboard could tell us a component existed. Only that other collection could tell us how it got there and who was responsible, which is the information policymakers need if they want to disrupt the supply chain rather than simply describe it.

That experience shaped how I think about the current issue. Open sources and closed collection are not competitors. The first made the second more efficient, because it let investigators ask better questions. The second made the first more meaningful, because it turned an interesting observation into an attributable finding. Treating either as a substitute for the other would have left us with a weaker product.

Defending the Analytical Craft

None of this is an argument against open-source intelligence. It is an argument for it, properly understood.

The practitioners who built the field's reputation, whether in newsrooms, nonprofits, academia, or government, are rigorous precisely because they distrust easy answers. They document their methods, show their chains of evidence, and say so when something can't be confirmed. That culture is the real asset. It is also what the commercial market is most at risk of undermining, because rigor is slow and expensive to sell, while a dashboard can be demoed in ten minutes.

The test I would offer any buyer, policymaker, or analyst is simple. When you are shown a claim, ask where it began, who else has independent knowledge of it, and what other collection could confirm or contradict it. If the system in front of you cannot answer those questions, it hasn't given you intelligence. It has given you a well-organized rumor.

The volume of open information will keep growing, and the tools to process it will keep improving. The scarce resource will not be data. It will be judgment, along with the access and tradecraft that make judgment possible. Agencies and firms that remember that, and invest accordingly, will see more clearly than those who confuse a full screen with a full picture.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Russia has demonstrated a growing willingness to use hybrid tactics – including sabotage, cyberattacks, information operations, and the use of deniable or “throwaway” agents – to create disruption and uncertainty across Europe. This paper examines how those tactics could be combined in a hypothetical Russian operation against Estonia designed not to defeat NATO militarily, but to create a crisis that tests the Alliance’s ability to respond quickly and collectively.

The scenario is deliberately constructed as a red-team exercise rather than a prediction. It envisions Russia exploiting the existence of Estonia’s Russian-speaking population, infiltrating operatives into the Schengen Area through legitimate visa channels, allowing those operatives to move through the largely borderless Schengen zone, and exploiting gaps in European immigration enforcement. The scenario culminates in a deliberately ambiguous armed crisis in Narva, accompanied by cyberattacks and a coordinated information campaign intended to complicate attribution and slow NATO decision-making.

The exercise identified several vulnerabilities. Some elements of the scenario are highly speculative, particularly Russian operatives' ability to obtain weapons once inside Estonia. Other elements, however, reflect existing conditions: Estonia’s large Russian-speaking population, the continued issuance of Schengen visas to Russian nationals, the decentralized nature of internal immigration enforcement, and the absence of a clearly identifiable EU-level capability dedicated to systematically analyzing the EES overstayer population for emerging national-security threats.

The paper therefore recommends three measures: continued EU-wide efforts to disrupt organized criminal networks that could provide support to hostile actors; eliminating tourist visas for Russian nationals except in limited humanitarian circumstances while developing a forward-deployed EU visa-security capability; and establishing a national-security immigration coordination center capable of analyzing immigration data against emerging threats and coordinating responses among Member States.

The central conclusion is that NATO’s military deterrence remains essential, but military strength alone cannot close every avenue through which a sophisticated hybrid operation could develop. Preventing such a crisis requires identifying and closing the less visible vulnerabilities that could allow hostile actors to establish themselves inside Europe before a crisis begins.

I. Introduction

Drones at Leipzig Airport. Drone incursions of NATO airspace. Throwaway agents. Arson and sabotage at facilities throughout Europe. 2026 has been a busy year, and it appears that Russia is engaged in an ongoing hybrid campaign on the European continent. The EU says that Russia’s goal is to spread fear, distrust, and undermine European unity. Additionally, just this Sunday, September 20, European security officials raised alarm that Russia is testing NATO resolve and could potentially even attempt a limited incursion into NATO territory.

This paper takes the current situation and threat picture as a starting baseline and imagines a scenario in which Russia creates a strategic crisis in Estonia, a NATO member, to discredit NATO collective defense and distract from the war in Ukraine by creating a sort of second front for NATO. In working through this thought exercise, the article examines what Russia could gain from escalation, how it might carry it out, and what security gaps the scenario identifies. Like with any hypothetical scenario, I suspect some will wholeheartedly disagree with my assertions. Still, I ask you to think of this as a red teaming exercise designed to identify vulnerabilities, and not an effort at forecasting.

II. Why might Putin want to escalate?

The “special military operation” that was supposed to take Kyiv in 6 days is going on for four years. Russia is not making significant gains on the battlefield, and whatever small gains it makes come at a prohibitive cost. The Center for Strategic and International Studies estimates that, since the full-scale invasion in 2022, Russia has suffered 450,000 dead and 1.4 million battlefield casualties. Moreover, Russian control of Ukrainian territory actually shrank in the Spring of 2026. The situation is so unfavorable that the Russian MoD now resorts to outright fabrication to claim battlefield gains that have not occurred.

Ukraine, on the other hand, seems to have stabilized its position after 4 years of war. It is becoming ever more adept at using drone technology and can finally bring the war home to Russia. Ukrainian long-range drones are now striking infrastructure deep inside Russia every week, including Russian oil refineries. This matters because Russian oil is the last remaining cash cow keeping the Russian economy afloat. And even though official Russian government numbers purport to show economic stability, a June report from the Kiel Institute for the World Economy concludes that “the Russian economy is showing clear signs of structural exhaustion.” Meanwhile, European support for Ukraine is strong across the continent, at least among mainstream political parties. On September 17, the EU Commission disbursed 3.3 billion euros to Ukraine – part of the 90-billion-euro Ukraine support loan. So in this war that increasingly looks like a war of attrition, it is Ukraine, and not Russia, that appears to be coming out on top.

In my assessment, these factors are gradually painting Putin into a corner, where he is slowly running out of options and may be forced to “flip the script.” In theory, one option Putin always has is a genuine move towards peace on fair terms, which should at minimum include a complete withdrawal of Russian forces from Ukraine. But he is stuck in a trap of his own making. If he relents on his maximalist demands and opts for fair peace, the entire very expensive and painful 4-year war would appear to have been fought for naught. That might very well threaten his political, or even personal, survival in a cutthroat political system. So, he is not willing to make peace. And sticking to business as usual looks like an eventual dead end as well.

In my imagined scenario, Putin invents a third option and chooses to escalate by launching a proxy military operation in Estonia. The operation has several goals. First, it aims to create a crisis NATO must solve on alliance territory, competing with NATO support for Ukraine. NATO would have to decide how to react to the crisis, and balance the reaction with the risk of escalation and full-blown war with Russia. Thus, as a second goal, Putin might succeed in discrediting Article 5 provisions of the defensive alliance if NATO’s response were to be slow or ineffective. Third, a military operation on NATO territory could force NATO partners to focus on their own defense rather than continuing to support Ukraine.

At first glance, this scenario may seem implausible or even reckless. After all, we have been almost conditioned to see NATO and Article 5 collective defense as an ironclad guarantee. This is one reason why countries that were formerly part of the Warsaw Pact flocked to NATO in the 1990s. But we also need to keep in mind that the concept of collective defense has not been routinely tested. Article 5 was invoked only one time – in the aftermath of the September 11 attacks against the United States. NATO has never dealt with a situation where an opponent seeks to test NATO boundaries by mapping out red lines, which I believe is exactly what Russia is doing. In other words, NATO has not yet been fully tested in hybrid war.

III. What might Putin assume about NATO?

We have discussed how the West views NATO. But what might Putin assume about the alliance, especially NATO’s willingness to go to war?

NATO is focused on defense and may prefer to avoid war. First, NATO explicitly describes itself as a defensive alliance and identifies preventing conflict and war as a core purpose of its deterrence and defense strategy. Putin could reasonably assume that NATO governments strongly prefer to resolve a confrontation without escalating it into a direct war with Russia. This does not mean NATO would fail to respond to an attack; rather, it creates a potential vulnerability that Russia could exploit by presenting NATO with an ambiguous crisis in which the costs of escalation are apparent, but the attribution of Russian responsibility remains contested.

NATO may be slow to act. An armed NATO response requires deliberation and consensus among alliance members. Article 5 obligations are triggered in instances of an armed attack, and determining whether an action is an armed attack is addressed on a case-by-case basis. NATO’s own materials note that “events that lack an international element, such as purely domestic acts of terrorism, do not trigger Article.” In Putin’s view, he could see case-by-case deliberations as a vulnerability and conclude that a deliberately vague scenario would make it difficult for the alliance to reach consensus quickly, keeping the window of action open for Russia.

Information operations may complicate consensus. NATO is a collective alliance of democracies, and democratic governments depend to some degree on public support and political legitimacy. In Putin’s assessment of the political situation, he may conclude that Moscow does not need to persuade NATO governments that Russia is innocent. It may only need to create enough confusion and debate within NATO populations to make decisive action more politically difficult. Russia has both the tools and demonstrated experience to flood the information environment with contradictory narratives. The U.S. State Department has documented Russian use of multiple, sometimes contradictory narratives specifically to generate confusion and discourage responses. NATO likewise describes hostile information operations as activities designed to “create confusion, deepen divisions, destabilize societies and ultimately weaken the Alliance,” and notes that such operations are not always intended to persuade audiences of a particular falsehood; they can instead be designed to muddy the information environment and make it more difficult to distinguish fact from fiction.

From Moscow’s perspective, the objective therefore need not be to achieve consensus around a pro-Russian narrative. It may be sufficient to prevent consensus around a coordinated response. If a crisis involving Estonia produced competing narratives about what happened, who was responsible, and whether Russia was directly involved, political divisions within individual NATO member states could complicate the Alliance’s response and make consensus harder to achieve.

Nuclear intimidation may complicate consensus. Putin may believe that nuclear signaling can amplify Western caution. Russia has repeatedly used explicit and implicit nuclear threats during the war in Ukraine. Evidence suggests these threats can have effects beyond traditional military deterrence, including a Chatham House assessment that Russian nuclear threats contributed to Western concerns about escalation and constrained some governments' willingness to provide Ukraine with certain forms of military support. This does not mean that Western populations will automatically oppose confrontation with Russia. Public attitudes toward nuclear deterrence have, in some cases, become more supportive since Russia's invasion of Ukraine. Rather, the point is that nuclear signaling adds an extra political cost to any decision to escalate a confrontation with Moscow. A Russian leadership that believes Western governments are highly sensitive to the prospect of nuclear escalation may therefore conclude that even an ambiguous or limited confrontation could be accompanied by nuclear rhetoric designed to encourage caution, delay, or disagreement within the Alliance.

Taken together, these assumptions suggest that what may appear from NATO’s perspective to be an irrational and extraordinarily risky decision—deliberately creating a crisis on NATO territory—could look considerably more rational from Moscow. Russia would not necessarily need to believe that NATO would stand aside. It would need to believe that NATO’s preference to avoid war, consensus-based decision-making, democratic political constraints, vulnerability to information manipulation, and sensitivity to nuclear escalation could create enough hesitation and disagreement to complicate a unified response. In this model, the objective would not necessarily be to defeat NATO militarily. It would be to create a crisis in which NATO’s overwhelming military advantage becomes difficult to translate into timely, unified political action. If Moscow believed such a crisis could fracture Alliance cohesion, force NATO to divert attention and resources from Ukraine, or show that Article 5 could be challenged without producing an immediate, unified response, the potential payoff might outweigh the risks in the Kremlin’s calculus.

IV. Free Narva – a Baltic hybrid war scenario

With the analysis of the previous sections in mind, I constructed a scenario in which Russia executes a deliberately ambiguous and confusing operation designed to threaten Estonia’s territorial integrity and test NATO’s resolve. In developing the scenario, I considered Russia’s potential objectives, lessons from previous Russian operations, the defensive measures Estonia and NATO have already adopted, and how Moscow might circumvent or exploit those defenses. This paper discusses the vulnerabilities identified through this process in a later section.

Phase 1 – Propaganda and throwaway agents

In October 2026, with the September Duma elections behind him and a comfortable supermajority win for his United Russia party, Putin decides to launch Operation “Narva Spring.” Analysts and think tanks pick up on increased messaging about the so-called “People’s Republic of Narva.” This is an entirely fictitious concept created by Russian intelligence, with a flag, notional borders, and a capital in Narva, a city of about 50,000 residents, 97% of whom are Russian speakers. The online narratives shared on Telegram, TikTok, and other platforms are the usual assortment of Kremlin grievance narratives about marginalized Russian minorities. Ongoing Estonian reforms that aim to make Estonian the official language of education in the country are weaponized and portrayed as “linguistic genocide” against Russian speakers.

The online propaganda campaign is amplified by Kremlin-controlled trolls and shared with pro-Russian Western influencers and political factions who decry Estonian government abuses of the Russian-speaking population. With the propaganda campaign at a fever pitch, the Kremlin is ready to escalate physically. But Russia cannot simply repeat the Crimea or Donbas scenario against Estonia. The Estonian border is one of the most heavily monitored frontiers in the world, where NATO has implemented a “deterrence by denial” strategy. This doctrine holds that defensive measures are so formidable the enemy sees an operation as too costly to attempt. Infiltrating several hundred “little green men” into Narva from Russia just across the river, while maintaining deniability, is not plausible. The Estonian side of the border is teeming with sensors.

But the Russians have been practicing another gray zone tactic recently – the use of “throwaway agents.” So, the Kremlin uses its network of low-level recruits to spray graffiti, place posters and stickers with QR codes, and eventually commit acts of arson and sabotage against local infrastructure and public property – and especially anything linked to law enforcement, security agencies and the courts. The goal is to create the appearance of local resistance against Estonian authority, while staying well beneath the threshold of armed conflict. But propaganda, graffiti, arson, and low-level sabotage are not the intensity of crisis the Kremlin needs. At this point, Russia needs to use specialists trained in fomenting armed violence on the ground.

Phase 2 – Infiltration

In 2014, Igor Strelkov emerged as the face of the armed separatist movement in Donbas, providing Moscow with something enormously valuable: an apparent local actor around whom an armed conflict could coalesce. To bring the Estonia situation from a nuisance to a crisis for NATO, Moscow needs people trained in violence, and a few Strelkov types to direct them. But how to bring them in? Estonia hasn’t allowed free travel for Russian citizens since 2022, and applications for entry for the few exceptions are closely scrutinized.

So, the Kremlin probes for weaknesses in the Schengen zone, and it finds these in Italy, France and Spain. In 2025, France, Italy and Spain collectively issued more than 441,000 Schengen visas to Russian nationals, while more than 477,000 Russian nationals received tourist visas across the entire Schengen zone. The refusal rate for Schengen visas for Russian nationals in 2025 was a mere 6.4%. The Schengen creates an interesting counterintelligence problem for Europe. Once a person has legitimately crossed the EU's external border, Europe's internal geography largely disappears.

In this scenario, Russia begins to infiltrate intelligence and military specialists from units like GRU’s Unit 29155 and the 390th Special Purpose Reconnaissance Point into the Schengen area starting in June 2026, before the launch of the Narva propaganda campaign and increased tensions. Even with the extra scrutiny for Russian visa applicants and shorter admission periods, the Russian operatives obtain tourist visas, enter Italy, and move with ease through Austria, Slovakia, Poland, Lithuania and Latvia via the excellent European train network and private commercial bus services. Once in Estonia, the operatives blend into the large Russian-speaking population and make their way to Narva. In total, just under a hundred Russian operatives follow this and other routes into Estonia over the summer months, and go to ground in the Narva region, supported by a tiny group of local sympathizers and a network of throwaway agents.

Even once the tourist visas of the Russian operatives expire, and they become illegal immigrants within the EU, nothing causes the system to blink red in reaction to this. In a way, no centralized, integrated system focuses specifically on immigration, so no lights blink red. Unlike the United States, Europe does not have an EU-wide interior immigration enforcement agency, and it currently lacks a central entity to monitor immigration violations against emerging national security risks, although that gap has been acknowledged. In terms of what exists today, in 2026, the EU rolled out the Entry/Exit System (EES), which captures biometrics from non-EU nationals entering the EU on short stays. So, in theory, the EES captures the biometrics of the Russian operatives in our scenario. And once their period of admission to the EU ends, typically at 90 days, the operatives are added to the EES “overstayer” list. But at present, unless the overstayer is also matched to additional alerts in the Schengen Information System – an EU-wide law enforcement database – no specific actions are automatically triggered, and law enforcement is not alerted.

Any interior immigration enforcement beyond this point is the responsibility of law enforcement within individual EU member states. If one of the operatives has the bad luck of being stopped by police and this results in a document check, the EES hit would likely show, and he would be detained. But the EES list is not proactively pushed to law enforcement for action. It is simply available to query. And importantly, EES is managed by eu-LISA – the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice – which is an agency focused on IT systems management and not law enforcement or security. In other words, no analysts are scouring the EES list for a sudden uptick in Russian nationals of military age being added to the overstayer list. Unless they attract attention to themselves, no one is coming for the Russian operatives. And in a city with a 97% Russian-speaking population, they don’t attract attention. Meanwhile, they quietly get to work acquiring small arms and mapping out critical infrastructure, communications, and defense and law enforcement sites.

Phase 3 – Estonian Donbas

By the end of 2026, the ground is set to initiate a crisis in earnest, in a way that gets NATO’s full attention. On January 2, 2027, a Saturday, Estonians are still recovering from the raucous New Year’s Eve celebrations. At 0700, Estonia's Information System Authority (RIA) Operations Center in Tallinn begins receiving simultaneous alerts indicating disruptions across government and critical infrastructure networks from unattributed sources. Analysts and incident handlers track the situation as key government and private-sector websites become unreachable due to denial-of-service attacks. Physical equipment begins to act erratically as unknown actors hack industrial control systems. Rail networks are disrupted. Traffic lights rapidly cycle in bizarre patterns. A few urban areas across Estonia lose electricity.

At the same time, radar operators identify air signatures from Russia, apparently heading toward Estonian airspace. Alert aircraft are scrambled. But the real crisis kicks off on the ground in Narva. Masked armed men, dressed in civilian clothing and wearing tricolor armbands, break into the empty Narva City Government building at Peetri Platz 5, climb their way to the top of the tower, and unfurl a green, black, and white flag. As the city government building is occupied and barricaded, another group of armed men attacks a nearby police station, overwhelms the skeleton crew, and takes a handful of hostages.

The last two groups are tasked with seizing the two border crossings across the Narva River. Narva 1 is the main border crossing point between Russia and Estonia, across the Friendship Bridge. A smaller, rarely used secondary crossing, Narva 2, sits about a mile south in a mixed industrial and residential area. The armed group attacking Narva 1 engages the border station building, about 380 meters from the foot of the bridge, drawing Estonian police defenders into a firefight. A second section of attackers takes up positions in the Narva Museum, a complex of 14th-century stone fortification with a commanding view of Friendship Bridge and the surrounding area, and supports the assault. Further south at Narva 2, the attackers similarly engage the border station, while setting up overwatch positions in the massive abandoned Kreenholm textile manufacturing complex.

While Estonian police defenders focus on attacks from the Estonian side of the border, additional attackers cross the bridges on foot and join the fight. These groups of men dressed in plain clothes are armed with heavier weapons including RPGs, squad machine guns and MANPADS. By 0800, both border crossings and bridges across the Narva River are seized, securing a thin but steady supply line from Russia. Reinforcements continue to stream into the city across the two bridges, and attackers strengthen their key defensive positions. Meanwhile, hundreds of small FPV drones appear in the skies above and begin hunting Estonian defenders. Anyone in a police or military uniform becomes a target.

Phase 4 – Information war

The chaos and fighting across Narva make for online content that quickly goes viral. With the hashtag #FreeNarva, videos of the chaos are shared across social media platforms, and pro-Kremlin trolls immediately label the situation as an uprising of the local population. A network of pro-Kremlin influencers in the West amplifies the content, then mainstream media in Europe and around the world pick it up. At 0900 local time, while the Estonian government and NATO are still trying to determine exactly what is happening in Narva and how to respond, the “separatist government” broadcasts its first official message from the seized City Government building.

Sitting behind a desk, with a black, green and white tricolor flag behind him, and flanked by armed men, the spokesperson announces the establishment of the Narva People’s Republic. In a short speech, delivered intentionally in Russian, he cites grievances against the Estonian government. He says the uprising is an act of self-preservation for Russian speakers in the region. Social media networks and news outlets quickly pick up the speech, adding to the moment's confusion. Kremlin trolls and their proxies call for support for the “world’s newest nation,” while cautioning against being pulled into World War Three by “Estonian fascists.” Memes quickly circulate featuring the mushroom cloud. Meanwhile, Russia expresses understanding of the separatist grievances but categorically denies having taken any part in the events. Putin appears on Russian television from a nuclear launch center and warns that an attack against Russian territory will result in a response using all available means.

Where does the scenario go from here? At minimum, Estonia would seek Article 5 consultations, but beyond that, the crisis could unfold in many different ways. I am not trying to explore every possible path. This hypothetical illustrates one way Russia could attack NATO territory while preserving enough ambiguity to complicate the Alliance’s response.

V. What gaps were identified?

Let us now examine how much of the hypothetical scenario reflects real-world vulnerabilities, how much was speculative, and what potential gaps the exercise identified.

Speculative Risk: Russian operatives' ability to acquire small arms once on the ground. The most speculative element of this scenario is the ability of Russian intelligence officers to acquire weapons through illicit means. While criminal networks trafficking illegal weapons exist and may extend into the Baltics, there is no basis to assume Russian operatives could readily access such networks without increasing the risk of detection. In the hypothetical scenario, weapons acquisition would therefore represent a significant uncertainty and a potential point of failure.

Confirmed Risk: Estonia has a large ethnic Russian and Russian-speaking population, with some evidence of social tensions in Narva, but the situation is nuanced. Official Estonian statistics show that ethnic Russians comprise about 20 percent of the country’s population. In Narva, approximately 97 percent of residents speak Russian. The relationship with Russia in Narva, however, is nuanced. After Estonia regained independence in 1991, many ethnic Russians who had settled in Estonia during the Soviet period did not automatically acquire Estonian citizenship and instead had to obtain citizenship through naturalization. Consequently, in 2014, only about 46 percent of Narva’s residents held Estonian citizenship, while 36 percent held Russian citizenship. Some Estonian government policies have contributed to local resentment, and these kinds of social friction points attract the attention of Russian intelligence services. However, there is no evidence of broad support in Narva for joining Russia, and documented reports indicate otherwise.

Confirmed Risk: The “Narva People’s Republic” is thought to be a Russian information operation. The idea of a “Narva People’s Republic” is not purely hypothetical. The current online campaign appears to have emerged in 2025 and became active in February 2026, when social-media accounts began promoting the idea of Narva and Ida-Viru County separating from Estonia. In March 2026, Estonia’s Internal Security Service characterized the activity as an information operation intended to sow confusion and undermine social cohesion.

Confirmed Risk: Russian nationals continue to receive Schengen visas with a relatively low refusal rate. Russians continue to receive short-stay visas into the Schengen zone. Although applications from Russian nationals receive more scrutiny now than in previous years, in 2025 Russian nationals applied for 679,425 short-stay visas, and 630,641 were issued, including 175,862 multiple-entry visas. The refusal rate for Russian visa applicants was only 6.4 percent according to official European Commission statistics.

Confirmed Risk: Absence of coordinated internal immigration enforcement and interoperability challenges. In our scenario, the fragmented nature of internal immigration enforcement in the EU was the biggest identified risk, as it allowed Russian operatives to move from their initial countries of admission to other parts of the Schengen area. The Entry/Exit (EES) system, fully deployed in April 2026, is a significant step toward gaining an operational picture of who enters and exits the Schengen area. Still, it works best for securing the EU’s external borders and preventing re-entry by previous violators. Individuals who do not leave the EU on time are added to the EES “overstayers” list, which is available to the member state competent authorities. But the overstayer list is just that – a list. To move from list to action, an individual on the overstayer list would need to have a “return order” (the EU version of a deportation order) issued by the competent member state authority. The order would need to be entered in the Schengen Information System (SIS) promptly. At that point, member states would need to coordinate to share SIS alerts and apprehend the individual. That could be facilitated through the SIRENE (Supplementary Information Request at the National Entries) bureaus, 24/7 centers each member state operates to facilitate information exchange. All that is possible if the system works without flaws, but that is not the current operational reality. The European Commission acknowledged in its 2026 State of Schengen report that interoperability and coordination remain challenging. The report specifically points out that “further efforts are required across all Member States to address challenges related to the timely issuance of return decisions, the streamlining of procedures and the implementation of measures to prevent absconding and unauthorized secondary movements.”

Confirmed Risk: Absence of a single entity that monitors the EES overstayer list for emerging security threats. Building on the previous risk factor, I could not confirm in my research the existence of a single EU entity that systematically monitors the EES overstayer population for emerging national-security threats based on targeting criteria. While extensive mechanisms exist for sharing information once a person becomes the subject of a relevant alert, it remains less clear who is systematically examining the EES overstayer population for national-security significance before that threshold is reached. The EU has an entity with extensive experience coordinating Member State investigations and criminal intelligence: EUROPOL, the European Union Agency for Law Enforcement Cooperation. EUROPOL has access to EES data for law-enforcement purposes, but its current EES capabilities are primarily integrated into existing investigative and analytical functions. EUROPOL itself identifies the need for greater interoperability among the EU's large-scale information systems and states that, once the planned changes are implemented by 2027, it will be able to use EES and other systems to “support assessing the security risks associated with third country nationals arriving to Europe.” At present, therefore, I found no evidence of a centralized process dedicated to systematically screening the EES overstayer population for national-security indicators. In other words, the EU has built the haystack and mechanisms for sharing information about individual needles, but it is less clear who is systematically looking for the needles. And because the EES is still new, the size and characteristics of the haystack are not yet fully established.

VI. Recommendations

I deliberately fashioned this scenario to unfold as a Russian operation against NATO might: deliberately ambiguous, difficult to attribute, and accompanied by an aggressive information campaign designed to complicate the Alliance’s response. The incursion itself would not necessarily need to be militarily successful. If Russia could create a crisis that divided NATO, delayed a unified response, or exposed weaknesses in the Alliance’s ability to defend its territory, the crisis itself could constitute a strategic success. For that reason, the most effective defense is to prevent the scenario from occurring in the first place—by identifying the vulnerabilities that could make such an operation possible and closing those gaps before Russia can exploit them.

NATO and Estonia are doing many things well, including their strategy of “deterrence by denial,” and I will not spend time analyzing those efforts here. They should continue. My recommendations instead focus on less frequently recognized vulnerabilities outside the traditional military sphere that could still be exploited in a hybrid conflict.

Recommendation 1: Continue EU-wide coordination targeting organized criminal activity. A key element of the hypothetical scenario depended on Russian operatives gaining access to firearms through criminal networks. Organized crime can provide illicit infrastructure that terrorists, intelligence services, and other national-security threats may exploit. Continued EU-wide efforts to disrupt these networks therefore serve a purpose beyond traditional crime reduction: they deny hostile actors access to networks, resources, and capabilities that could facilitate operations inside Europe.

Recommendation 2: Eliminate tourist visas for Russian nationals and create a forward-deployed EU visa security program for high-threat regions. One of the larger gaps identified in this scenario is that Russian nationals still have legal avenues to obtain visas to enter the EU. My recommendation would be to stop issuing tourist visas to Russian nationals, with exceptions for limited humanitarian circumstances. The EU should also consider a uniform, EU-wide mechanism to systematically assess the security risks posed by visa applicants and incorporate those assessments into visa issuance decisions. While the EU has a sophisticated common visa-information system, including biometric screening and mechanisms for sharing information among Member States, responsibility for visa adjudication and national-security assessment remains distributed among national authorities. The United States provides one potential model. Through HSI’s Visa Security Program, trained special agents are assigned to diplomatic posts overseas to conduct law-enforcement interviews and identify terrorists and other national-security threats before they enter the United States. A comparable EU capability, whether centralized or deployed through participating Member States, could add an investigative and intelligence dimension to the existing European visa-screening architecture.

Recommendation 3: Establish a national-security immigration coordination center within an appropriate European agency. The EU should consider establishing a dedicated national-security immigration coordination capability within an existing agency such as EUROPOL. The center would proactively analyze the EES overstayer list and other relevant databases against current threats, identify concerning emerging patterns, centralize alerts concerning visa overstays and other significant immigration violations, and provide a mechanism for Member State coordination. Where an overstay or other immigration violation involves additional security indicators, the center could elevate the case for immediate coordination with the appropriate law-enforcement and intelligence authorities in the affected Member State. The objective would be to move beyond simply recording immigration violations toward proactively identifying those that may represent emerging national-security threats.

VII. Conclusion

The purpose of this exercise was not to predict that Russia will attack Narva, or that events would unfold exactly as described. It was to show how a deliberately ambiguous hybrid operation could exploit vulnerabilities outside the traditional military sphere. Russia would not necessarily need to defeat NATO on the battlefield. It could seek to create a crisis in which attribution is uncertain, information is contested, political leaders face competing pressures, and the Alliance must make consequential decisions under extreme uncertainty.

That is why prevention matters. Once armed men are occupying buildings in a NATO member state and information operations are shaping the narrative faster than governments can establish the facts, the opportunity to prevent the crisis has already passed. The objective should therefore be to identify the vulnerabilities that make such a scenario possible while there is still time to address them. NATO's military deterrence and Estonia's defenses remain essential, but closing the less visible gaps in Europe's immigration, intelligence, law-enforcement, and information-security architecture may be just as important in preventing the next hybrid crisis from becoming a reality.

At minimum, these measures would make it significantly harder for Russia, or any hostile actor, to establish the personnel, infrastructure, and freedom of movement needed to conduct such an operation inside Europe.

Disclaimer

The views expressed in this article are the author’s own and do not reflect the official position of the U.S. Department of Homeland Security, Homeland Security Investigations, or the U.S. government.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Houthis bloodied Saudi Crown Prince Muhammad bin Salman’s nose—again—with their deadly, cruel, but effective attacks on Riyadh’s King Khalid International Airport last week. The strikes are the latest in a series of mostly self-inflicted setbacks—exacerbated by President Trump’s ill-considered war with Iran—that have frustrated the Crown Prince’s now decade-old aspirations to turn Saudi Arabia into a global economic, financial, and military powerhouse. Instead, MbS’s faltering economic reforms, combined with his bad bet on relying on Donald Trump as a security partner, are yet another reminder that Saudi Arabia is a weak state, dependent on and vulnerable to the whims of more powerful outside actors. And more than ever, the Saudis don’t have a good way out of that predicament.

The roots of MbS’s cascading problems lie in the early years of his de facto reign, which began in 2015, when he assumed the roles of defense minister and deputy crown prince. They stem from his personal arrogance and foreign misadventures, as well as his more admirable recognition—poorly acted upon—that the Saudi kingdom was, and remains, a relic in need of modernization and a future beyond hydrocarbons.

Over several years, MbS shattered Al Saud governing norms; alienated and pushed aside many members of the large and mostly indolent royal family; and sidelined the kingdom’s religious establishment (good riddance, say I). He also alienated neighbors such as Qatar and the UAE, ultimately to Saudi Arabia’s detriment, and started a war with the Houthis that he lost—and is now losing again.

MbS also unleashed much-needed economic and social reforms (women can now—gasp!—drive). The economy has gone from being mostly driven by government spending to being slightly less so. Homeownership is up, and unemployment among Saudis is down, according to IMF data. Nonreligious tourism grew from 2019 until last year, albeit from a low base. And Aramco’s kind-of, sort-of IPO in 2019 raised billions to support MbS’s ambitions in what was then the largest such offering in global equity history, although it now seems quaint beside the $85 billion SpaceX IPO.

But extravagant government spending in pursuit of unproductive, unachievable vanity projects (NEOM, anyone?) and MbS’s wild overestimation of the resources at his disposal are hobbling his ability to pursue the Vision 2030 economic reform program. And it turns out that, beyond the usual cadre of foreign finance bros and management consultants who are happy to bill the Saudi government by the hour or by the project, outside investors who could provide the capital and expertise needed to make the reforms viable are not convinced that Saudi Arabia is a place where they want to do business at the scale MbS needs. Net foreign direct investment in the kingdom last year was only about one-third of what the Saudi government had envisioned under Vision 2030. And, it goes without saying, 2026 is not proving to be a good year, with the IMF estimating that FDI will fall by about one-third.

The Crown Prince’s problems are not all of his own making, of course. But even so, his miscalculations have exacerbated the difficulties he is now struggling to address. The Iran war has scrambled the kingdom’s security and economic calculations, inviting Iran and its Houthi allies to prey on a country woefully unprepared for conflict despite decades of profligate but mostly ineffectual defense spending. The extravagant welcome MbS accorded Trump in Riyadh early last year has gained the Saudis mostly nothing. It’s not just that the Saudis—and other Gulf potentates, to be sure—assess that President Trump has treated them shabbily. It is that the American military has so far proved unable to achieve anything better than a stalemate against a third-rate regional power—Iran—with all the implications that sad fact holds for the region and for our global standing and credibility.

So where does this leave the now-middle-aged Crown Prince and the country he rules as he contemplates the coming decades of his reign? Recalibrating and scrambling, to be sure. Many of the investment megaprojects that were once cornerstones of his Vision 2030 program are dead or on life support. Three prominent examples are the now-bankrupt, Saudi-financed LIV Golf league; The Line at NEOM; and the absurdly overpriced, vanity-driven $50 billion giant cube, the Mukaab in Riyadh. And the economic pain is bleeding into other prestige projects as well, including the postponed (read: canceled) Asian Winter Games originally scheduled for 2029. The tens of billions spent—and the tens of billions more not spent because the country can’t afford it—have left the Saudis mostly where they were after all their past failed efforts to diversify the economy: reliant on hydrocarbons to sustain it and pay the government’s bills. Vision 2030 has changed that at the margins (and the vibes of living in and visiting the country are certainly different), but not in a fundamental way.

Compounding MbS’s woes, of course, is the regional security earthquake brought about by Trump’s Iran war. The United States is receding and retreating from its role as regional hegemon and the Crown Prince can be under no illusion that this will change after Trump leaves office in 2029. The Saudi brand is toxic among Democrats, and the emergence of the US as the global energy superpower under President Obama and during the first Trump administration has fundamentally changed the relationship between Riyadh and Washington. So, again, Riyadh is reduced to trying to do what it has always been forced to do: seek outside protection while also accommodating its adversaries.

The Crown Prince’s options are not good. His much-vaunted security agreement with Turkey and Pakistan demonstrates how poor his alternatives are to the now-defunct Pax Americana—and must also be personally humiliating. After all, one of his putative new protectors, President Erdoğan, gleefully embarrassed the then-young Crown Prince after Saudi agents murdered Jamal Khashoggi in Turkey in 2018. And anyone who has spent time in the kingdom knows well the lingering distaste for—and insecurity about—the country’s former Ottoman masters. As for Pakistan, it takes little imagination to understand how that benighted and impoverished country is viewed by the kingdom’s ruling family.

At a more practical level, Turkey and Pakistan will never replace the military capabilities of the United States, and both countries’ commitment to their new security agreement will be limited by the simple fact that Iran holds them at risk as well. Riyadh’s security strategy will probably closely resemble its current response to the Houthi threat, as detailed in a recent Wall Street Journal article: scouring the globe for weapons to defend against missiles and drones, contemplating hiring mercenaries to fight in Yemen in lieu of Saudi forces that are demonstrably not up to the task, and quietly seeking an accommodation with the Houthis to try to make the whole thing go away. In a region fundamentally altered by the US-Iran war—with US credibility as a security partner in tatters and Iran emboldened, if weakened—good luck with that.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Washington made three decisions this week, and none of them has an end date. On the night of October 14, Ukrainian units in the field found that their Starshield terminals had been capped at a speed, 160 kilometers an hour by the published figure, 70 by President Zelensky's account two days later, which cuts off any strike drone that flies faster than the cap. Reuters reported, citing American and Western officials, that the order came from inside the White House; a senior official said the President had made no such request. Service was reported partly restored by October 15. No terms were ever published. The restriction followed a week in which American negotiators had warned Kyiv that intelligence sharing could be suspended if strikes on Russian energy targets continued, and in which the President announced an "energy ceasefire," which President Zelensky said was "news for me." Ukraine paused its refinery campaign for three days. On October 15, Zelensky told the Financial Times, "We're done," and that morning Rosneft's Ryazan refinery burned. The same day, CNN reported that Ukraine had run out of Patriot interceptors.

Two days later, on Friday afternoon, the President signed an executive order implementing the sanctions act passed by Congress in September. Its second section imposes what the law required by October 18: a 500 percent duty on Russian goods and a 100 percent duty on goods from any country that continues buying Russian crude or gas. Its fourth section waives both, along with eleven other sections of the act, until the President or the Secretary of State decides otherwise. The order names no country, mentions no fuel, and sets no date. The White House said enforcement now "would impede" the search for peace. Diesel in the United States stood at $6.33 a gallon on Saturday, higher than on the day the Russian diesel license was issued.

Last week, in these pages, I argued that no single authority in Washington was charged with weighing the sanctions against the price of fuel, and that whichever claim had the nearest deadline would win. This week, the President himself weighed the claims, and the ranking is visible in the two documents: the diesel license and the peace track outranked the statute, and the ally's campaign was slowed to protect them. Washington gave the peace track as its reason for the first and denied ordering the second. Whatever each was meant to do, both eased the pressure on Moscow in the weeks before November 3. That is a decision, and it bound the only party it could reach, the ally. It is also the week's lesson, because of what it did not contain.

It contained no horizon. The waiver has no end date. The throttle has no published terms. The diesel license runs through April. Each can be reversed by the same hand on any morning, which means none of them bind the party across the table; they inform him. Moscow learned that a license and a telephone call can buy a pause in the campaign against its refineries. Beijing, which must decide by November 10 whether to extend the suspension of its rare-earth licensing rules for American buyers, learned the price at which American pressure lifts, a month before the President arrives in Shenzhen. New Delhi, the act's principal target, received a waiver that asks nothing of it. And every ally that fights on an American-controlled communications or targeting layer learned that the layer can be set to a speed, without announcement, and that the setting is deniable. The European Union's foreign policy chief said the following day that Europe cannot replace Starshield in the short term.

The parties for whom the pressure was built spent the week waiting. Russia's first licensed diesel cargo, 40,000 tons loaded at Primorsk, sailed for Morocco. The volumes could not have moved the American price in any case: the 300,000 tons promised "immediately" are less than a day of American consumption. Tehran kept the American counterproposal under review and held to its sequence, the strait first and enrichment after, while flows through Hormuz ran at 11.6 million barrels a day, down from a pre-war 17.2, and a Singapore-flagged container ship sank, its port authority confirmed, after being struck. The International Energy Agency reported the world's oil stocks 509 million barrels below their pre-war level and agreed on Thursday to release what remains of the barrels pledged in March. Economic warfare is now being fought on two clocks. The West's runs to its elections and its inventories. The other side's runs to neither.

There is precedent for winning a contest of this kind, and it was won by time rather than force. In June 1948, the Soviet Union closed the roads and railways to West Berlin. The Western allies responded with an airlift. The blockade was lifted on May 12, 1949, after eleven months, not because the aircraft had defeated anything, but because Moscow concluded that the West could hold its position longer than Moscow could sustain the blockade. The instrument that prevailed was the horizon, and the West had shown it could keep it.

The remedy I named last week, a single authority to rank competing claims, turns out to be necessary but not sufficient. The authority existed this week and used itself. What it lacked was a commitment that outlasts the next election: a stated date and condition under which the pressure lifts, a provision of fuel and interceptors that carries the country to that date, and an officer beneath the President charged with holding the ranking when the price of diesel argues for changing it. In practice that is a sunset clause: the waiver expires on a date unless the President certifies to Congress why it should not. A sanction without a horizon is a disclosure. A satellite link without published terms is a lever on the ally rather than the adversary.

If you advise on these instruments, the decision you owe this quarter is a horizon. Before the next sanction is signed, the next license issued, or the next allied system switched on, put the date in the document: the condition under which the pressure ends, the provision that carries you there, and the office that holds the line until it arrives. The side that can wait chooses the day. This week, it was not ours.

Richard Berry is the founder and principal of Stratnova Advisors and a former Senior Executive who led the Commander's Action Group at U.S. Indo-Pacific Command; he publishes the weekly assessment Strategic Horizons.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Recent deadly attacks by Yemen's Iranian-backed Houthis inside of Saudi Arabia have raised questions about just how far the U.S. should go in helping to protect the Kingdom. We spoke with former National Intelligence Manager for Iran at ODNI, Norm Roule , who travels regularly to the region for meetings with senior leaders and asked him to help us better understand the realm of possibility.

The Cipher Brief: What exactly can the United States provide to or undertake for the Saudis that the Kingdom cannot do on its own?

Roule: The Royal Saudi Air Force is experienced, well-led, and well-resourced with advanced technology, and it can draw on a deep relationship with U.S. Central Command (CENTCOM). Riyadh also has decades of experience dealing with Yemen. Its understanding of Yemen’s political, tribal, and military landscape is as granular as one could reasonably hope. Saudi officials responsible for managing this portfolio have repeatedly sought political and diplomatic solutions with the Houthis and other Yemeni factions. The failure of these efforts reflects Houthi unwillingness to make necessary compromises more than any lack of effort on the part of the Saudis or the United Nations. It should also be remembered that the Saudis have sought Western and international engagement on this issue for years, just as they have warned repeatedly of the consequences of allowing the Houthis to acquire sophisticated ballistic missile and drone capabilities with Iranian assistance.

In terms of the ongoing conflict, Washington has reportedly responded robustly to Saudi requests for support, providing munitions, maintenance, intelligence, and other assistance needed to improve operational effectiveness, protect personnel, and minimize civilian casualties. There remain areas in which the United States and other partners can provide additional capabilities that would likely be welcomed by the Kingdom, particularly in integrated air and missile defense, early warning, intelligence collection, and replenishment of interceptor inventories. These capabilities are particularly important given the challenge of defending against coordinated missile and drone attacks, including attacks designed to overwhelm defensive systems. The United States can also assist in identifying and disrupting the networks responsible for supplying the Houthis with missile and drone components.

We must also distinguish between Saudi air superiority from the ability to locate and destroy dispersed, mobile, or concealed Houthi missile and drone capabilities. There is no public evidence that Saudi aircraft are unable to meet their current targeting requirements or that direct U.S. air operations would fundamentally change the course of the conflict. The question is whether there are specific military capabilities or operations that Washington can provide that would materially improve Saudi security beyond what Riyadh and its Yemeni partners can accomplish themselves.

A comment on the GBU-43/B Massive Ordnance Air Blast bomb (MOAB). Unlike the GBU-57 Massive Ordnance Penetrator, which is designed to destroy reinforced or deeply buried underground facilities, the MOAB is an airburst weapon that detonates just above the ground. Its principal value lies in its devastating effects against concentrated personnel and exposed targets, its potential effectiveness against certain cave and tunnel complexes, and its considerable psychological impact on enemy forces and their leadership.

One can envision circumstances in which such a weapon might be useful in Yemen, including against certain underground missile storage facilities, manufacturing locations, or concentrations of Houthi missile and drone operators. However, its effectiveness would depend on the characteristics of the target, including the depth and reinforcement of underground structures. It is unlikely to resolve the broader missile and drone threat, much of which depends on mobile launchers, dispersed equipment, and facilities that may be difficult to locate. Its employment would also require consideration of potential civilian casualties. Most importantly, its use makes sense only if suitable targets exist that cannot be addressed as effectively by Saudi or Saudi-supported Yemeni government operations, and if we judge that destroying those targets would materially alter the course of the conflict without risking broader U.S. involvement.

The Cipher Brief: How would direct U.S. involvement in Yemen affect our operations against Iran?

Roule: Iran remains, and should remain, the principal focus of our military efforts in the region. Tehran would welcome nothing more than an American decision to become embroiled in another regional conflict. Although not all military assets or munitions are interchangeable, additional commitments of aircraft, intelligence capabilities, logistical support, and senior military attention to Yemen could divert resources that might otherwise support operations against Iran. This is particularly important given the demands of maintaining the blockade, securing the Strait of Hormuz, conducting defensive operations with our Gulf partners, and potentially preparing for expanded operations against Iran itself.

We should not, however, assume that every action against the Houthis would necessarily weaken our campaign against Iran although we do need to consider the cost to broader U.S. military requirements. The Houthis remain one of Tehran’s most important instruments of regional coercion, and effective measures to reduce their ability to attack Saudi Arabia could reinforce our broader strategy against Iran. The issue is whether the military and strategic benefits of any proposed American operation against the Houthis would justify the resources involved and the risks of escalation. This requires distinguishing limited defensive assistance, which could strengthen our regional posture, from offensive operations that might require a sustained American military commitment.

Direct U.S. military involvement against the Houthis would also risk unraveling the existing U.S.-Houthi ceasefire and exposing American forces to renewed attacks, potentially setting off a chain of events that could lead to another open-ended military campaign. Our engagement with the Houthis to sustain the ceasefire may not be attractive symbolically, particularly as Houthi attacks against Saudi Arabia continue. But the arrangement has preserved American military resources and operational flexibility for the confrontation with Iran. We should not abandon that advantage without compelling evidence that doing so would produce meaningful strategic gains.

The Cipher Brief: This is a tricky situation. The U.S. wants to be seen as a strong and reliable security partner, but Houthi attacks against Saudi Arabia are likely to continue. How can the administration walk this line?

Roule: The Administration will need to thread this needle carefully. It has reportedly intensified its already extensive discussions with Riyadh concerning what more can be done to protect Saudi lives, airspace, critical infrastructure, and energy facilities against continued Houthi attacks. The Kingdom’s security is not simply a matter of regional symbolism or alliance credibility. Attacks against Saudi territory threaten civilian lives, economic activity, international aviation, energy infrastructure, and the Kingdom’s ambitious economic transformation. This has a national, regional, and even global impact. Saudi Arabia’s ability to defend itself against these threats is critical to American national security and economic interests.

Our support will need to become more visible, particularly as the Saudis face growing domestic and regional expectations that their security partners will respond to attacks on the Kingdom. But visibility must be accompanied by meaningful results. Additional air and missile defense capabilities, intelligence cooperation, replenishment of defensive munitions, and measures to disrupt Houthi weapons supply networks may ultimately offer greater strategic value than direct American strikes. These measures would also demonstrate that Washington takes Saudi security seriously without necessarily expanding the American military commitment.

A MOAB strike would certainly attract attention and demonstrate American willingness to employ overwhelming force. But visibility alone is not a measure of military effectiveness or strategic success. Any such operation must be judged by whether it would significantly degrade Houthi capabilities, deter further attacks, or otherwise change the course of the conflict. A dramatic strike that fails to reduce the Houthi threat could actually weaken deterrence by demonstrating the limits of American military power. Conversely, a carefully selected operation against a critical Houthi capability could reinforce deterrence if its military benefits justified the risks.

The larger objective must remain to demonstrate that the United States is a dependable security partner without allowing the Houthis, and ultimately Iran, to draw us into another costly and potentially open-ended conflict. We should do everything possible to support our Saudi partners in defending their people, territory, and critical infrastructure against Houthi attacks. But our actions must be designed to achieve meaningful military and strategic results while preserving the resources and operational flexibility needed for the confrontation with Iran. Protecting Saudi Arabia against Iranian-supported aggression should reinforce, not undermine, that effort. Iran remains our principal adversary, and bringing that confrontation to a successful conclusion must remain our primary objective.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Ayatollah Ali Khamenei’s death led to greater decentralization of the regime and a more collective, securitized decision-making system. In Iran today, authority is distributed across several actors and groups, in which the military-security network has gained disproportionate agenda-setting power.

There has been much speculation about how decisions are made in Iran following the death of Supreme Leader Ali Khamenei. There has been a diffusion of power since his demise and the elevation of his son Mojtaba Khamenei as his successor. To understand current leadership dynamics in Tehran, there are three overlapping levels to consider: individuals, institutions, and networks. Increasingly, they all operate around one overriding concern: regime survival.

The result is the transformation of the Islamic Republic from a more personalized leadership at the end of Ali Khamenei’s rule to a more security- and military-centered form of collective leadership. While certain individuals are on display, institutions still organize and implement decisions. Crucially, a network of power shapes and provides policy choices for decision-making. Because of war and instability, the security and military network has ultimately become the most powerful among others.

At the first level of decision-making stands individuals. When Ali Khamenei was alive, he was the final arbiter on matters of strategy and policy. After his death, power has become more diffuse. This is especially true given that his son and successor Mojtaba Khamenei has been neither seen nor heard from since his elevation as supreme leader. This has left the Iranian system releasing old archival images of Mojtaba Khamenei, written statements, and in one case a purportedly handwritten note to the commander of the Islamic Revolutionary Guard Corps (IRGC) Aerospace Force to create the impression that he is in charge.

Additionally, Iranian officials like President Masoud Pezeshkian have recounted only a few hours-long meetings with the new supreme leader, which are hard to verify. Other regime figures like Mojtaba Khamenei’s mother-in-law have insisted he was present at the burial of his father despite no videographic or photographic evidence that he was there. A clerical speaker at one recent nighttime rally in Tehran recently suggested the new supreme leader was at the rally just 30 minutes before he spoke.

Despite these attempts to portray Mojtaba as in command, already, reports have circulated of demoralization among the Islamic Republic’s core base in Iran with a supreme leader who is absent from public view. This is a sea change in the way Iran has operated since 1979. An accessible and visible supreme leader always served as the glue which held the Iranian establishment together. Ali Khamenei was a regular presence on state television—and Iranian officials often interpreted his public remarks as directives. Today with Mojtaba Khamenei absent, this is growing more difficult and has added confusion. As one former IRGC officer recently told Iran Wire, “now, if Mr. Mojtaba issues an order, it reaches officials through intermediaries, leaving everyone uncertain whether the message was distorted along the way. Officials trust one another even less than before; small cliques based on family or personal ties have formed.”

Today the individuals comprising key decision-making and shaping include Secretary of the Supreme National Security Council (SNSC) Mohsen Rezaei; Chief Justice Gholamhossein Mohseni-Ejei, IRGC Commander-in-Chief Ahmad Vahidi, President Masoud Pezeshkian, Speaker of Parliament Mohammad Bagher Ghalibaf, and Chief of Staff of Iran’s Armed Forces Ali Abdollahi. Within this circle of power, the IRGC plays an outsized role. This group also has interpersonal dynamics which impact strategy. Rezaei and Ghalibaf are both outsized personalities who have harbored competing political ambitions. Ghalibaf and Abdollahi are longtime associates, with Abdollahi having been promoted to a variety of state positions under Ghalibaf’s tutelage. Vahidi served under Rezaei when he headed the IRGC. Pezeshkian and Foreign Minister Abbas Araghchi are likely more eager for an immediate diplomatic settlement given their roles in day-to-day state administration than the IRGC’s top brass like Vahidi, who may believe time is on the Islamic Republic’s side and is more interested in reestablishing deterrence.

After the individuals, come the institutions that administer the country and make strategic decisions. The presidency and ministries remain important for daily governance and implementing state strategy. But when it comes to matters of national security and regime survival, the center of gravity shifts towards the military-security establishment. The SNSC connects the political, military, intelligence, and bureaucratic institutions.

Behind these institutions lay informal networks based on family, personal, and professional ties, especially those who fought wars together like veterans of the Iran-Iraq War. Within the military-security establishment, these ties are embedded in the IRGC, the Intelligence Ministry, and among military commanders. Within the economic and political class, these networks prevail among state-linked companies, parastatal foundations, contractors, oil traders, financial intermediaries, and sanctions evaders.

The clerical elite also maintains significant ideological and religious networks, especially within seminaries, among Friday Prayer leaders, and the many overlapping propaganda institutions of the Islamic Republic. Bureaucratic-technical elites also have networks, among diplomats, economists, engineers, nuclear experts, and administrators who make the government run.

These networks matter because they shape what information reaches the decisionmakers in Iran, how threats are defined, and which policy options are considered palatable. Disagreements do exist, but they, for now, remain concentrated on tactics, not grand strategy. All are committed to the founding principles of the Islamic Republic. For example, diplomats may favor negotiation. Economic officials will emphasize the costs of war. Military commanders will prioritize deterrence. Ideological actors will resist compromise and fear infiltration of American and Western mores. These factors are weighed by the Islamic Republic through the lens how best to preserve the system. Likewise, while disagreement is genuine, the actors do not all have equal influence.

The war with the United States and Israel has accelerated securitization. Economic unrest, social protests, information, foreign policy, and nuclear policy are all viewed as security issues. As threats increase, security institutions gain influence over areas previously dominated by civilian institutions.

In this mix, Iran’s national interests and the survival of the Islamic Republic are not always identical. A policy may appear economically irrational but still be political rational if leaders believe it protects the regime. The central paradox confronting Iranian leaders is that Tehran has incentives to end a costly conflict, but also incentives to avoid an agreement that looks like surrender or demonstrates weakness. The late Supreme Leader Ali Khamenei often looked to the example of the collapse of the Soviet Union and the reforms undertaken by Mikhail Gorbachev like perestroika and glasnost as mistakes. The lesson Khamenei took away from these experiences is such reforms invite weakness, which the West preys upon and this could facilitate the end of the Islamic Republic. Such logic likely continues to animate Iranian decisions.

Whether Mojtaba shares his father's ideology is not as important as Khamenei’s institutional legacy that his worldview has left behind. This is the logic of what we call the Islamic Republic 3.0. In the Islamic Republic 3.0, there is a greater diffusion of power where individuals decide, institutions organize and implement, and networks shape the choices. Power is increasingly shifting toward the security establishment.

For policymakers in Washington, this has important implications; who makes decisions in Iran no longer has a simple answer. When the bombs hit the Office of the Supreme Leader in February 2026, Araghchi was briefing Khamenei’s security advisor Ali Asghar Mir Hejazi on recent talks with Washington. But today, Araghchi admitted over the summer that he had never had a personal interaction with the new supreme leader and Mojtaba Khamenei has not announced advisors to replace Hejazi, whom was reportedly opposed to his ascension as supreme leader.

If President Trump were to renew military action against Iran after the midterm elections, U.S. policymakers would need to confront these new layers of decision-making to further weaken the regime. Should decapitations form part of these operations—as was the case during Operation Epic Fury—solely striking Supreme Leader Mojtaba Khamenei would not suffice to weaken the regime even more. U.S. bombing would need a more expansive approach, targeting entire institutions like the SNSC.

Araghchi himself signaled this vulnerability in the regime during an interview in July with journalist Javad Mogooyi. He said, “The regime would collapse if all members of the SNSC are hit, which is why they never met at once during the war.” This would entail precise intelligence and targeted killings of individuals like the SNSC secretary, president, foreign minister, intelligence minister, chief justice, speaker of parliament, chief of staff of the armed forces, and the commanders-in-chief of the IRGC and Artesh. Additionally, aiming at the second and third layers beneath each of these figures would be required.

This is because not only would individuals on the SNSC be eliminated, but an entire institution would be decapitated. And the networks that fed into those members would be severed.

Saeid Golkar is the UC Foundation associate professor of political science at the University of Tennessee at Chattanooga and a senior advisor at United Against Nuclear Iran. Jason M. Brodsky is the policy director at United Against Nuclear Iran.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Anti-Semitism, the Rev. Dr. Martin Luther King Jr. pronounced while repudiating an anti-Israel resolution adopted at the 1967 National Conference for New Politics, is “immoral.” Accordingly, the civil rights leader would surely have been dismayed at the prevalence of that age-old prejudice in the wake of the barbarous October 7, 2023, terrorist attack on Israel. Nor would he necessarily have accepted the cynical camouflaging of anti-Jewish prejudice as “anti-Zionism.” At an October 1967 dinner, according to sociologist Seymour Martin Lipset’s later eyewitness account, King rebuked a student: “When people criticize Zionists, they mean Jews. You’re talking anti-Semitism!”

Moreover, Dr. King saw the fight against that age-old hatred as congruent with the civil rights struggle. In a June 1965 message, he wrote, “We deplore anti-Semitism as we deplore discrimination and segregation in Mississippi and Alabama." Given his awareness of Soviet intelligence attempts to discredit him by portraying him as an “Uncle Tom” secretly receiving U.S. government subsidies, King might also have recognized the pattern identified by the U.S. Department of State’s Global Engagement Center: after October 7, the Kremlin fanned “the flames of antisemitism” while seeking to “discredit, divide, and weaken” its adversaries, particularly the United States.

It was not surprising that members of the so-called “Axis of Autocracies”—united by a common antipathy toward the United States—would mount influence operations aimed at exploiting that awful day. China, for its part, seeks to portray the United States as a violent, racist, politically riven, dysfunctional, declining power. As part of a state-linked operation, Chinese actors pretending to be Americans have leveraged divisive issues—including the Israel-Hamas war—to portray the United States as a country with weakleadership and a failing political system. This covert messaging campaign has been augmented by the distribution of more inflammatory material—including provocative memes and AI-generated images—on Western-facing Chinese diplomatic and state-affiliated accounts.

Iran has been much less subtle in its post-October 7 influence operations. Iranian actors have deployed fake personas, sock-puppet networks, hacked material, and cyber operations designed to support Hamas and discredit Israel. Neither the tone nor the aggressiveness of those actions is unexpected, given that Tehran’s ideological messaging—in accord with that of its terrorist proxies, Hezbollah, Hamas, Palestinian Islamic Jihad, and the Houthis—has long been premised on cries of “death” to the “Great” and “Little” Satans. Publicly available information does not establish that Moscow, Beijing, or Tehran created, directs, or controls the broader movement being advanced by an unholy coalition of the radical left and Islamists. Those governments have, however, identified and amplified real divisions in American society, often injecting poisonous content into them.

Of the latter-day Axis states, Russia has been especially forceful in its post-October 7 influence operations. After Hamas’s attack, Russian state media and Russia-linked covert networks rapidly exploited the war to promote anti-American themes and exacerbate tensions among the parties. Russian actors circulated manipulated videos and false stories, including fabricated claims that Ukraine had supplied Hamas with Western weapons. Some material was deliberately designed toresemble reporting from legitimate Western media. According to the Department of Justice (DOJ), in 2024 the Russian government directed a “Doppelganger” influence operation that used fake personas, paid advertisements, fabricated media brands, and websites designed to impersonate legitimate U.S. news organizations; internal planning documents also contemplated AI-generated content. The operation’s goals included sowing division inside the United States, weakening support for U.S. foreign policy, and underminingAmerican relationships with allies, including Israel.

Russian intelligence services and Kremlin-directed influence organizations clearly regard anti-Semitic, anti-Zionist, and Israel-related polarization as exploitable American vulnerabilities and have demonstrated the capability and intent to amplify such divisions. Moscow has taken a pro-Palestinian position on the Israel-Hamas war while promoting conspiracy theories, ethnic tensions, and politically inflammatory narratives. Russian messaging fuels American domestic discord by hammering home claims—such as “Zionists control Washington”—that appeal to parts of the far left, far right, and isolationist middle. It also seeks to reinforce pernicious narratives that the United States causes instability; that its position on Israel exposes Western hypocrisy; that Ukraine and Israel receive Washington’s support while Americans suffer at home; and that the United States cannot be trusted asan honest broker in international affairs.

That the operational methodology Russia employs in pursuit of these goals reflects Moscow’s long-standing “active measures” (‘aktivnyye meropriyatiya’) doctrine—identifying divisions, entering debates through apparently legitimate accounts, intensifying antagonism, encouraging opposing groups to distrust one another, and thereby weakening social cohesion—is no accident. Like many Russian intelligence operations, Moscow’s current active-measures program has roots in the Soviet era. After Israel’s victory in the 1967 Six-Day War, the KGB’s Service A intensified an anti-Israel active-measures campaign that has echoes today. Cold War Romanian intelligence officer Ion Mihai Pacepa later described part of that campaign as “Operation SIG,” intended to undermine support for Israel, damage U.S. influence in the Middle East, and widen the political divide between Washingtonand the Arab and Muslim worlds.

According to Pacepa, “SIG”—derived from the Russian phrase for “Zionist Governments” (‘sionistskoye gosudarstvo’)—was a clandestine propaganda and disinformation effort directed against Israel and its principal supporter, the United States. After Soviet-aligned Arab states were soundly defeated on the battlefield, Moscow sought to reframe the Middle East conflict, portraying Israel not simply as an Arab adversary but as an imperialist, colonialist, and racist extension of American power. Pacepa attributed to KGB chief Yuri V. Andropov the statement that the KGB “needed to instill a Nazi-style hatred for the Jews throughout the Islamic world.” The instruments available to Service A for clandestinely disseminating this theme included forged documents, front organizations, agents of influence, covert political support, and manipulation of foreign media. According to Pacepa’s account, those tools were used to place stories in sympathetic or controlled media, circulate inflammatory literature, exploit existing anti-Semitic material, provide covert assistance to organizations capable of repeating Soviet themes, and amplify them through Soviet-bloc and developing-world media.

Operation SIG sought to establish several mutually reinforcing propositions: that Israel was an illegitimate imperialist, colonialist state; that Zionism was inherently racist; that Israel and the United States constituted a single strategic enemy; and that the Palestinian struggle formed part of a worldwide “national liberation” movement. Indeed, according to KGB foreign-intelligence archivist Vasili Mitrokhin, “Zionism was second only to the United States (‘the Main Adversary’) as a target for KGB active measures.” As with other active measures, success could come from polarization, repetition, and erosion of confidence in an adversary’s motives, thereby improving Moscow’s geopolitical standing and influence. This constituted less a single disinformation story than a sustained campaign that developed and clandestinely circulated a narrative, placing it through ostensibly independent sources, encouraging sympathetic organizations to repeat it, and relying on repetition to confer apparent legitimacy. The objective was not necessarily to persuade audiences to accept every assertion. Rather, it was to establish a narrative that undermined the American position in the Middle East by portraying Washington as incapable of acting independently of Israel.

There is a striking thematic resemblance between several narratives promulgated by Operation SIG and rhetoric now used by some far-left, revolutionary socialist, anti-Zionist (a euphemism for raw anti-Semitism), and Islamist activists in the United States. The resemblance is reflected in a number of fallacious, often contradictory propositions: Zionism equals racism; Israel is a settler-colonial state; Zionism is tied to fascism; Israel is an instrument of American imperialism; “Zionists” control U.S. policymaking; Israel is an imperialist outpost; the United States and Israel constitute a single oppressive system; and violent Palestinian or Iranian-aligned “resistance” is part of a broader anti-imperialist struggle. This does not mean that Moscow controls today’s American protest movement.

What is, however, demonstrably true is that the recycling of an ideological vocabulary—albeit with the mendacious substitution of the label word “Zionist” for “Jew”—that Soviet active measures spent decades promoting internationally lives on in that movement and the language it employs. Operation SIG is illustrative of a fundamental principle of Soviet disinformation that continues in Russian operations today: Do not manufacture a grievance when an authentic grievance can be weaponized. The most effective active measure rarely invents an issue from nothing. It identifies a genuine conflict or prejudice and then manipulates, radicalizes, and internationalizes it.

Apart from the deliberate perversion of the historical significance of the Holocaust with the antithetical assertion that Israel’s justifiable response against those who conceived, directed, and participated in the heinous October 7 attack constitutes genocide, the chief difference between what the KGB did in SIG and what Russian intelligence is doing today is the speed with which disinformation and propaganda can now be created and disseminated. Whereas the KGB of the 1970s needed agents of influence, front organizations, controlled newspapers, forgeries, clandestine payments, friendly Communist parties, and sympathetic journalists willing to place stories that could take months to prepare and be circulated widely enough to have an impact, its Russian successors can utilize social media, fake Americans, AI-generated photographs, deep-fakes, bot networks, controlled influencers, and algorithmic amplification to spread disinformation themes at scale in a matter of hours.

In so doing, Russian intelligence systematically takes the most incendiary versions of American political arguments and makes them appear more popular, more widespread, and more authentic than they really are. The originating intelligence service no longer needs to control the narrative. Once an ideological concept becomes embedded in political culture, an active measures operation can become self-sustaining as genuine activists reproduce it voluntarily.

Building on Operation SIG, our adversaries are turning our democratic system inside out by using against us the freedom of speech we value and that is anathema to them. To those who argue today—as they did in his day—that the enlightened and anti-racist could not succumb to anti-Jewish prejudice, George Orwell had a rejoinder. “People of left opinions,” he wrote in 1945, “are not immune to it.” Revolutionary Marxists, progressive anti-colonial activists, Palestinian nationalists, and some imported Islamist or Iranian-aligned activists are converging around a common concept: “Anti-imperialism.” Organizations whose underlying ideologies would otherwise appear incompatible are united by hatred for the U.S., its democratic ideals, and its history. They also share a very thinly veiled anti-Semitic worldview and a common desire to destroy Western civilization.

In his landmark 1963 Letter from Birmingham Jail, Dr. King reminded us that "Injustice anywhere is a threat to justice everywhere” and that “We are caught in an inescapable network of mutuality, tied in a single garment of destiny. Whatever affects one directly, affects all indirectly.” Although those words addressed the evil of segregation, King later explicitly invoked the Holocaust in the same letter. Explaining the distinction between law and justice, he observed that Nazi persecution was carried out under German law, whereas resistance to it was illegal. He then declared, “Had I lived in Germany at the time, I would have aided and comforted my Jewish brothers.”

King’s words provide an appropriate warning for our own time. The lesson of Operation SIG is not that Moscow created anti-Semitism or the political divisions concerning Israel, but that an adversary can identify such divisions, sharpen them, legitimize their most poisonous expressions, and ultimately induce others to propagate them voluntarily. What once required the KGB years of painstaking active measures can now be accomplished—and amplified globally—in hours. In such a milieu, Orwellian inversions of the truth can be made to appear more plausible for the very simple reason that they are delivered to target audiences before any countervailing argument can be mustered.

The danger, therefore, lies not simply in Russian, Chinese, or Iranian disinformation, but in our willingness to become its unwitting agents of influence. A democratic society cannot defeat foreign propaganda by abandoning the freedoms that distinguish it from its adversaries. It can, however, recognize when old prejudices have been repackaged in fashionable political language and refuse to lend them legitimacy. King understood that anti-Semitism was not made less immoral by the ideology in which it was cloaked. Nearly sixty years later, that remains a lesson worth remembering.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the US Government. Nothing in the contents should be construed as asserting or implying US Government authentication of information or endorsement of the author's views.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

“And now, there is war again. There is new competition between great powers. There is vulnerability, aggression, terrorism, a whole universe of new threats and attacks again. And so, we must rebuild our institutions and our alliances to face these threats together.” From Secretary of State Marco Rubio’s October 7th speech in Greece, at the Acropolis. Mr. Rubio’s excellent speech should be mandatory reading for high school and college civics classes.

Mr. Rubio’s message was clear: He warned that Western nations are at a critical inflection point, facing a choice between maintaining global leadership or sliding into “atrophy, servitude, and decline”.

Francesco Sisci, a Sinologist and Director of Rome’s Appia Institute, says America is failing to exercise leadership and is pushing Europeans toward China.

Recent public opinion polls and surveys across Europe show shifting views in how Europeans view the U.S. and China.Trust in the U.S. alliance and traditional transatlantic ties has dropped significantly, while public favorability toward Chinese leadership in some European nations has occasionally edged higher than views of U. S. leadership.

Some of this can be attributed to the U.S. pivot to Asia during former President Obama’s presidency, with many in Europe thinking the U.S. focus shifted from the transatlantic relationship to Asia.This pushed the Europeans toward a China that projected a message of success, with modern technologies and new infrastructure.

However, the Europeans discovered there are drawbacks when dealing with China. China’s currency, the Renminbi (RMB), is not freely convertible, restricting cross-border movement of investments, stocks, bonds, real estate, and loans. And their territorial claims to Taiwan and the South China Sea are issues of concern in Europe, as is China’s support to Russia and Iran.

On October 9, the European Union (EU) and China reached a landmark interim trade agreement to curb the influx of Chinese vehicles, avoiding a full-scale trade war. The EU and China established a 16-point consensus aimed at balancing an unsustainable European trade deficit with China.

Another European concern is the rise of right-wing populist and nationalist parties. This trend is highlighted by the Alternative for Germany (AfD) successes in eastern states like Saxony and neighboring Saxony-Anhalt.Many view this shift as a critical threat to EU solidarity and democratic institutions, while hard-right factions celebrate it as a democratic mandate against failed mainstream policies.

What’s driving this shift? In Germany, a geographic and political divide has placed eastern states at the forefront of the country’s rightward shift. This shift is fueled by sharp economic anxieties and intense anti-immigration sentiment and a perceived detachment of the ruling coalition in Berlin. This has normalized AfD support across a broad voter segment, especially young people.

Germany’s domestic intelligence agency has formally designated the AfD branches in Saxony and Saxony-Anhalt as “confirmed right-wing extremist” organizations.

Centrist governments in Europe are alarmed by the pro-Russian, anti-NATO, and anti-Ukraine-aid rhetoric from groups like the AfD.With over a quarter of European voters supporting hard-right platforms, centrist governments warn that the Western alliance’s united front against external geopolitical threats is under siege.

The AfD’s eastern factions reportedly have ties to radical extremist and neo-Nazi elements, thus motivating Marine Le Pen in France and Prime Minister Giorgia Meloni in Italy to distance their parties from the AfD, and expelling the AfD from their main coalition in the European Parliament.Despite this, far right-wing populist parties in the 31 European nations are gaining momentum, with approximately 23% of the electorate voting for right-wing populist parties.

According to Mr. Sisci, even the Vatican is concerned with this shift to far-right political groups, viewed by many as heirs of the Fascists.

Mr. Sisci said the U.S. must be at the center of these geopolitical discussions, with strong U.S. leadership. Without this, there will be chaos.

And as Mr. Rubio said in Greece, at the Acropolis, “It shows us that ours is the inheritance of great heroes, and that we should be proud – intensely proud – of where we come from. We should marvel at what our forefathers carved out of this countryside. The story of our civilization is the greatest story ever know to man.”

The author is the former associate director of national intelligence. All statements of fact, opinion o analysis expressed ae those of the author and do not reflect he official positions or views of the U.S. government.

This article was originally published in The Washington Times.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief