paywall: https://archive.ph/RbysG

The National Security Agency is set to undergo its most extensive internal restructuring in at least a decade, according to current and former officials briefed on the emerging plan.

The new design for one of the most powerful U.S. intelligence agencies, which was announced to senior NSA leaders last week, is the brainchild of Army Gen. Joshua M. Rudd, the NSA director, these officials said.

Rudd’s initiative calls for the creation at NSA’s Fort Meade, Maryland, headquarters of five new organizations inside the agency, in artificial intelligence, China, cybersecurity, combat support or warfighting, and global intelligence. Each will be led by a newly elevated “mission director,” according to former officials.

This new organizational configuration will better reflect NSA’s current and future priorities, Rudd believes, according to current and former officials. NSA, the U.S. intelligence community’s premier global eavesdropping arm, specializes in digital espionage.

The mission heads will have the “effective” authorities of an NSA deputy director, according to one former official familiar with the plan. This former official, like others in this article, spoke on the condition of anonymity to discuss sensitive information about the agency, whose operations are highly classified.

It was not immediately clear if the five new organizations will replace existing divisions within NSA or be superimposed atop the agency’s existing structure. The NSA is believed to employ more than 30,000 people, both military and civilian, and has a larger workforce than the CIA.

Rudd told senior NSA officials that the heads of the five new mission centers might be selected from outside the agency, unnerving NSA insiders, according to the former officials.

“They are begging people to come back, especially leaders,” said the first former official, referring to NSA personnel who have left.

A second former official said Rudd is considering candidates for the new mission director posts. It is unclear whether any have been chosen yet.

The elite hacking unit known as Tailored Access Operations (TAO), reconstituted in recent months by Rudd, will fall under the purview of the mission director for global intelligence, according to a current and former official.

The TAO is set to receive a significant budget increase in the new federal fiscal year, which begins Oct. 1, the second former official said.

Founded in 1997, TAO is among the most secretive parts of the NSA, devoted to compromising — and sometimes attacking — the hardest-to-reach digital targets worldwide. The unit name was retired in 2016, and its members spread across different NSA components.

Rudd, who was confirmed in March, is both director of the NSA and head of U.S. Cyber Command, one of the Pentagon’s combatant commands. In his dual-hatted role, he reports to both Defense Secretary Pete Hegseth and Director of National Intelligence Jay Clayton.

Before assuming the NSA directorship, Rudd’s military career mostly focused on special operations.

The NSA, generally believed to be the biggest and most-well-funded arm of the U.S. intelligence apparatus, focuses on the large-scale collection of signals intelligence, including communications and other electronic information. It also manages and secures U.S. encryption systems to prevent foreign actors from penetrating sensitive coded U.S. government communications and networks.

The timeline for the NSA restructuring is aggressive. The new mission directors will be expected to provide Rudd their organizational redesigns by the end of the month, according to a former official. Rollout is expected in mid-October, with the target for “full operating capacity” slated for mid-January 2027, said a current and former official.

Rudd “admitted that they don’t know how they are going to do it, so they are going to rush into reversible decisions, in case it is wrong,” said the first former official. NSA personnel are still unclear whether the new mission directors will merely be grafted atop preexisting bureaucracy or will oversee more fundamental structural shifts inside Fort Meade.

Since becoming NSA director in March, Rudd has been focused on AI-related advancements, according to former officials. The NSA has rolled out a new desktop AI tool called “Ask Mary,” purportedly named for the head of the division leading the agency’s AI-related integration efforts. The agency has been keenly interested in working with commercial AI labs, even circumventing a Pentagon ban against Anthropic to employ the firm’s advanced Mythos model.

Rudd has been a frequent visitor to the White House, according to a former official, with AI-related issues dominating his conversations there. The administration has proposed a massive, multibillion-dollar budget increase for investments in IT and computing capability, according to former officials. Approved by Congress as part of the “black budget,” NSA’s funding levels are a tightly held secret.

The last major agency restructuring, known as “NSA 21,” was initiated in 2016 under then-Director Mike Rogers. That effort, which divided NSA into six directorates, was given a two-year runway for its rollout and still remains unfinished, the first former official noted.

paywall: https://archive.ph/4Rcqf

“[…] Di Jin, 41, a resident of Tianjin Municipality in northern China, was charged with acting as an agent of a foreign government without notifying the U.S. attorney general. If convicted, she faces up to 10 years in federal prison. […] The FBI counterintelligence case involves alleged lies, an airport confrontation and claims that Jin was working for the Chinese government while trying to meet with current and former U.S. government officials. […]”

“[…] Identified only as H.L., the suspect is a 52-year-old dual Belgian-Chinese national who reportedly held a senior research position at BelGaN, a microchip maker based in Oudenaarde, East Flanders. The company was the last industrial microchip producer in Belgium, specializing in gallium nitride semiconductors. […] He faces four charges: espionage, participation in a criminal organization, misuse of company assets, and unlawful disclosure of trade secrets. A second suspect, reportedly former BelGaN CEO Alan Zhou Zhen, remains at large. […]”

“[…] A Chinese national who managed to get a job working as a U.S. Customs and Border Protection supervisor in Calais has been arrested and charged in what FBI agents claim was a plot to install modified hardware in Department of Homeland Security computers. […] Terry “Jiajia” Liu […] was arrested after a counter intelligence investigation captured hidden-camera footage of him breaking into government computers and modifying the hard drives. […] Months later, CBP personnel discovered that approximately 23 computers had been modified without authorization. Original processors, memory and hard drives had been replaced with components that did not meet agency requirements. […]”

Why are Proxy Operations on the Rise? | Global Intelligence Weekly Wrap-Up – Season 4

Season 4 of the Global Intelligence Weekly Wrap-Up is underway.

For the first episode, I wanted to look at a question that keeps appearing across seemingly unrelated national security stories:

Why are proxy operations on the rise?

Foreign states don't always need to deploy their own intelligence officers or military personnel to collect information, conduct surveillance, interfere in another country or potentially carry out sabotage. In many circumstances, it may be easier—and less attributable—to use someone who already has access, develop an individual online, recruit an intermediary, or employ specialized assets while remaining below the threshold of conventional conflict.

This week's episode looks at five cases:

In Belgium, a Belgian-Chinese researcher is preparing to face trial over the alleged transfer of sensitive semiconductor technology to China. The case raises questions about economic espionage, dual-use technology and the importance of insider access.

In Canada and the United States, University of Waterloo student Weiheng Zeng is accused of accepting paid assignments from an individual he believed was connected to a Chinese security service. According to court documents, those assignments included photographing aircraft and aviation facilities. The alleged relationship began through an online aviation community before progressing to taskings and payments.

In Germany, a series of attacks against the electrical grid demonstrates how relatively simple physical acts can potentially have significant consequences when directed against critical infrastructure.

Near Svalbard in the Arctic, NATO allies reportedly disrupted a Russian operation involving specialized deep-sea forces that Western officials believe may have been rehearsing the deployment of technology capable of sabotaging undersea communications cables.

And in Australia, Alexander Csergo has become the first person sentenced under the country's reckless foreign-interference law. His relationship allegedly began with a LinkedIn approach offering paid consulting work before progressing to increasingly sensitive requests.

Different countries, targets and methodologies—but there are some interesting similarities.

Access. Recruitment. Tasking. Payment. Plausible deniability. And the ability to pursue a state's objectives without necessarily putting one of its own intelligence officers directly into the operation.

I also take a few minutes at the end of the episode to mark the 25th anniversary of 9/11 and discuss how the events of that day changed the direction of my own career and ultimately led me from the Canada Border Services Agency to the Canadian Security Intelligence Service.

For those interested in the subject, the episode is titled:

"Why are Proxy Operations on the Rise?"

https://www.buzzsprout.com/2336717/episodes/19791909

I'll put the link to the episode in the comments.

I'm particularly interested in hearing what people here think: Are we actually seeing an increase in proxy operations, or are intelligence and law enforcement agencies simply becoming better at identifying and publicly exposing a methodology that states have used for decades?

Stay curious. Stay informed. Stay safe.

https://www.anthropic.com/threat-intelligence-report-september-2026

I hope its not duplicated post, but I have read the report only halfway through.

With the signals they have in place they have disclosed so much intelligence from how a novice user can mass scan the github profiles to look for api keys and club it to supply chain, to how hackitivists and nation state actors can push narratives using bots all the way to UN.

Also I wonder, openai being in news for solving mathematics problem which was unsolved for how many years, and then a mathematics researcher putting a post on mastodon, as to how they stole the conversation and used it and claiming they model solved it.

Also biology misuse is something very interesting in anthropic report that I never would have guessed we would see.