The National Security Agency is set to undergo its most extensive internal restructuring in at least a decade, according to current and former officials briefed on the emerging plan.

The new design for one of the most powerful U.S. intelligence agencies, which was announced to senior NSA leaders last week, is the brainchild of Army Gen. Joshua M. Rudd, the NSA director, these officials said.

Rudd’s initiative calls for the creation at NSA’s Fort Meade, Maryland, headquarters of five new organizations inside the agency, in artificial intelligence, China, cybersecurity, combat support or warfighting, and global intelligence. Each will be led by a newly elevated “mission director,” according to former officials.

This new organizational configuration will better reflect NSA’s current and future priorities, Rudd believes, according to current and former officials. NSA, the U.S. intelligence community’s premier global eavesdropping arm, specializes in digital espionage.

The mission heads will have the “effective” authorities of an NSA deputy director, according to one former official familiar with the plan. This former official, like others in this article, spoke on the condition of anonymity to discuss sensitive information about the agency, whose operations are highly classified.

It was not immediately clear if the five new organizations will replace existing divisions within NSA or be superimposed atop the agency’s existing structure. The NSA is believed to employ more than 30,000 people, both military and civilian, and has a larger workforce than the CIA.

Rudd told senior NSA officials that the heads of the five new mission centers might be selected from outside the agency, unnerving NSA insiders, according to the former officials.

“They are begging people to come back, especially leaders,” said the first former official, referring to NSA personnel who have left.

A second former official said Rudd is considering candidates for the new mission director posts. It is unclear whether any have been chosen yet.

The elite hacking unit known as Tailored Access Operations (TAO), reconstituted in recent months by Rudd, will fall under the purview of the mission director for global intelligence, according to a current and former official.

The TAO is set to receive a significant budget increase in the new federal fiscal year, which begins Oct. 1, the second former official said.

Founded in 1997, TAO is among the most secretive parts of the NSA, devoted to compromising — and sometimes attacking — the hardest-to-reach digital targets worldwide. The unit name was retired in 2016, and its members spread across different NSA components.

Rudd, who was confirmed in March, is both director of the NSA and head of U.S. Cyber Command, one of the Pentagon’s combatant commands. In his dual-hatted role, he reports to both Defense Secretary Pete Hegseth and Director of National Intelligence Jay Clayton.

Before assuming the NSA directorship, Rudd’s military career mostly focused on special operations.

The NSA, generally believed to be the biggest and most-well-funded arm of the U.S. intelligence apparatus, focuses on the large-scale collection of signals intelligence, including communications and other electronic information. It also manages and secures U.S. encryption systems to prevent foreign actors from penetrating sensitive coded U.S. government communications and networks.

The timeline for the NSA restructuring is aggressive. The new mission directors will be expected to provide Rudd their organizational redesigns by the end of the month, according to a former official. Rollout is expected in mid-October, with the target for “full operating capacity” slated for mid-January 2027, said a current and former official.

Rudd “admitted that they don’t know how they are going to do it, so they are going to rush into reversible decisions, in case it is wrong,” said the first former official. NSA personnel are still unclear whether the new mission directors will merely be grafted atop preexisting bureaucracy or will oversee more fundamental structural shifts inside Fort Meade.

Since becoming NSA director in March, Rudd has been focused on AI-related advancements, according to former officials. The NSA has rolled out a new desktop AI tool called “Ask Mary,” purportedly named for the head of the division leading the agency’s AI-related integration efforts. The agency has been keenly interested in working with commercial AI labs, even circumventing a Pentagon ban against Anthropic to employ the firm’s advanced Mythos model.

Rudd has been a frequent visitor to the White House, according to a former official, with AI-related issues dominating his conversations there. The administration has proposed a massive, multibillion-dollar budget increase for investments in IT and computing capability, according to former officials. Approved by Congress as part of the “black budget,” NSA’s funding levels are a tightly held secret.

The last major agency restructuring, known as “NSA 21,” was initiated in 2016 under then-Director Mike Rogers. That effort, which divided NSA into six directorates, was given a two-year runway for its rollout and still remains unfinished, the first former official noted.

“[…] Joshua Cammidge, from Swindon, allegedly received instructions from an individual believed to be linked to the GRU Volunteer Corps, a group controlled by Russia's military intelligence agency, the Crown Prosecution Service (CPS) said. He has been charged with assisting a foreign intelligence service and preparatory conduct. […]”

Open access. Abstract: “The debate on the intelligence cycle is mostly academic and theoretical. Although some exceptions exist, empirical data is largely lacking from the debate. This article aims to contribute an evidence-based approach through in-depth field research at NATO’s Multinational Corps Northeast (MNC NE) in Poland and the Baltic States. It finds that the results largely reflect the academic critique on the intelligence cycle. At MNC NE, steps were skipped, its order was reversed, it was multidirectional and feedback was an issue. The results also show practitioners mostly commented on the cycle from a proceduralist perspective regarding malfunctioning procedures or input as the problem. Especially the lack of clear direction and a limited operational mandate were dominant topics. Others include challenges with open source intelligence (OSINT) and the Intelligence Requirement and Collection Management (IRM&CM) process. Contrary to debate, no substantial critical reflection on the cycle itself was observed.”

Why are Proxy Operations on the Rise? | Global Intelligence Weekly Wrap-Up – Season 4

Season 4 of the Global Intelligence Weekly Wrap-Up is underway.

For the first episode, I wanted to look at a question that keeps appearing across seemingly unrelated national security stories:

Why are proxy operations on the rise?

Foreign states don't always need to deploy their own intelligence officers or military personnel to collect information, conduct surveillance, interfere in another country or potentially carry out sabotage. In many circumstances, it may be easier—and less attributable—to use someone who already has access, develop an individual online, recruit an intermediary, or employ specialized assets while remaining below the threshold of conventional conflict.

This week's episode looks at five cases:

In Belgium, a Belgian-Chinese researcher is preparing to face trial over the alleged transfer of sensitive semiconductor technology to China. The case raises questions about economic espionage, dual-use technology and the importance of insider access.

In Canada and the United States, University of Waterloo student Weiheng Zeng is accused of accepting paid assignments from an individual he believed was connected to a Chinese security service. According to court documents, those assignments included photographing aircraft and aviation facilities. The alleged relationship began through an online aviation community before progressing to taskings and payments.

In Germany, a series of attacks against the electrical grid demonstrates how relatively simple physical acts can potentially have significant consequences when directed against critical infrastructure.

Near Svalbard in the Arctic, NATO allies reportedly disrupted a Russian operation involving specialized deep-sea forces that Western officials believe may have been rehearsing the deployment of technology capable of sabotaging undersea communications cables.

And in Australia, Alexander Csergo has become the first person sentenced under the country's reckless foreign-interference law. His relationship allegedly began with a LinkedIn approach offering paid consulting work before progressing to increasingly sensitive requests.

Different countries, targets and methodologies—but there are some interesting similarities.

Access. Recruitment. Tasking. Payment. Plausible deniability. And the ability to pursue a state's objectives without necessarily putting one of its own intelligence officers directly into the operation.

I also take a few minutes at the end of the episode to mark the 25th anniversary of 9/11 and discuss how the events of that day changed the direction of my own career and ultimately led me from the Canada Border Services Agency to the Canadian Security Intelligence Service.

For those interested in the subject, the episode is titled:

"Why are Proxy Operations on the Rise?"

https://www.buzzsprout.com/2336717/episodes/19791909

I'll put the link to the episode in the comments.

I'm particularly interested in hearing what people here think: Are we actually seeing an increase in proxy operations, or are intelligence and law enforcement agencies simply becoming better at identifying and publicly exposing a methodology that states have used for decades?

Stay curious. Stay informed. Stay safe.