EXPERT PERSPECTIVE — Iran is experiencing its most consequential period of internal unrest in years. Nationwide demonstrations driven by economic collapse, social grievance, and political frustration have been met with force, mass arrests, and near-total information control. The scale and coordination of the response suggest a regime that feels threatened but not unmoored, confident in its ability to absorb pressure while preventing fragmentation.
This moment has reignited debate in Washington about escalation, leverage, and the possibility—explicit or implicit—of regime collapse. That debate is familiar. The United States has confronted similar moments before, most notably in Afghanistan and Iraq, where early assumptions about pressure, legitimacy, and endurance proved wrong.
This article is not an argument for restraint or intervention. It is a warning drawn from experience: without understanding how competition unfolds below the level of open conflict - the gray zone - pressure alone does not produce favorable outcomes. Iran today sits at the center of a problem the United States has repeatedly misunderstood - not the use of force, but what comes before and after it.
Afghanistan and Iraq: Where Strategy Slipped
In Afghanistan, the United States removed the Taliban from power quickly. In Iraq, Saddam Hussein’s regime collapsed even faster. In both cases, the decisive phase of the conflict ended early. What followed was the harder contest—one defined less by firepower and more by local power structures, informal authority, and external interference operating quietly and persistently.
In Afghanistan, as I witnessed firsthand, regional actors adapted faster than Washington. Iran, Pakistan, Russia, and later China treated the conflict as a long game. They invested in relationships, cultivated influence, and positioned themselves for the post-U.S. environment years before the withdrawal. The result was not an immediate defeat on the battlefield, but a strategic hollowing-out of the state.
Iraq followed a similar trajectory. Iranian-aligned militias embedded themselves within neighborhoods, religious institutions, and political parties. Over time, they became inseparable from the state itself. U.S. military dominance did not prevent this. In fact, it often obscured it, until the architecture of influence was already in place.
The lesson from both cases is straightforward: control of territory is temporary; control of networks endures.
Iran Is Not Afghanistan or Iraq — But the Pattern Rhymes
Iran today is often discussed as if pressure will produce rapid political change. That assumption ignores how power is organized inside the Islamic Republic.
Iran’s security model is deliberately social. The Basij is not simply a paramilitary force; it is embedded across society—universities, workplaces, neighborhoods, religious institutions. Its purpose is not only repression, but surveillance, mobilization, and ideological reinforcement. This structure was built to survive unrest, sanctions, and isolation.
Externally, Iran has exported the same logic. In Iraq, allied militias function simultaneously as armed actors, political movements, and social providers. In Afghanistan, Iran preserved influence across regime changes, maintaining access to key actors even after the fall of the Republic. These are not improvisations; they are the product of decades of learning.
It is worth remembering that Iran was not a spectator during the U.S. presence in Afghanistan and Iraq. It observed American methods up close—what worked, what failed, and where patience outperformed power. Tehran adapted accordingly.
Why Escalation Without Preparation Backfires
Moments of internal unrest often create pressure for external action. Yet Afghanistan and Iraq show that collapse—real or perceived—creates its own risks.
Removing a regime does not dismantle informal power structures. It often accelerates their consolidation. Networks that survive pressure are the ones that define what comes next. Iran’s internal system is designed precisely for this kind of stress: decentralized, redundant, and socially embedded.
There is also a strategic paradox at play. External pressure can validate internal narratives of siege and foreign threat, strengthening coercive institutions rather than weakening them. Information controls, security mobilization, and proxy signaling are not reactions; they are rehearsed responses.
This is why simplistic comparisons—whether to Eastern Europe, Latin America, or past protest movements, are misleading. Iran’s political ecosystem is closer to the environments the United States faced in Kabul and Baghdad than many in Washington are willing to admit.
Who’s Reading this? More than 500K of the most influential national security experts in the world.
None of this suggests that Iran is immune to pressure or that its current trajectory is stable. Economic distress, generational change, and legitimacy erosion are real. But history cautions against assuming that pressure equals control or that unrest equals opportunity.
The more relevant question for U.S. policymakers is not whether Iran is vulnerable, but whether the United States is prepared to operate effectively in the space that follows vulnerability.
That preparation requires understanding how authority is distributed beneath formal institutions, recognizing how coercive and social systems reinforce one another, and anticipating how regional actors adapt during periods of instability.
These are the same lessons Afghanistan and Iraq offered lessons learned too late.
Iran’s current unrest has reopened a familiar debate in Washington about pressure, leverage, and escalation. But Afghanistan and Iraq should have settled that debate long ago. The United States did not lose those conflicts because it lacked military power; it lost because it underestimated how authority, loyalty, and influence actually function inside contested societies.
Iran is not a blank slate, nor is it a fragile state waiting to collapse under external strain. It is a system built to absorb pressure, manage unrest, and outlast moments of crisis. Any approach that treats unrest as an opportunity without first understanding what follows it risks repeating the same strategic error the United States has already made—twice.
The choice facing U.S. policymakers is therefore not whether to act, but how to act without misunderstanding the terrain. Escalation without preparation does not produce control; it produces consequences that others are better positioned to manage. If Washington has truly learned from Afghanistan and Iraq, it will recognize that the most dangerous moment is not the collapse of order, but the false confidence that comes before it.
History will not judge the United States on whether it applied pressure. It will judge whether it understood what that pressure would unleash.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief.
The United States has increased deliveries of weapons systems, ammunition, and military equipment to the Middle East since late 2025, with U.S. Air Force transport aircraft conducting intensified flights from the continental United States to European logistics hubs and onward to bases in Jordan, Israel, Qatar, and Saudi Arabia, according to open-source flight tracking and […]
Iran’s central bank quietly built up a large stash of Tether’s USDT last year as the rial struggled and trade with the outside world grew harder. The move turned parts of the crypto ledger into a public trail of a policy that would normally be private.
Central Bank’s Crypto Moves
According to a blockchain analysis by Elliptic, the Central Bank of Iran acquired at least $507 million in USDT over 2025, a figure the firm treats as a conservative minimum because it only counts wallets it could tie to the bank with high confidence.
Reports say much of the buying happened in the spring months of 2025 and that payments were routed through channels that included Emirati dirhams and public blockchains. Those stablecoins were then used in local crypto markets to add dollar-linked liquidity and help slow the rial’s slide.
New Elliptic research: We have identified wallets used by Iran’s Central Bank to acquire at least $507 million worth of cryptoassets.
The findings suggest that the Iranian regime used these cryptoassets to evade sanctions and support the plummeting value of Iran’s currency,… pic.twitter.com/I7NHGO0wtP
Elliptic’s tracing shows an early flow of USDT into Nobitex, Iran’s biggest crypto exchange, where the coins could be swapped into rials and fed into the market. After a breach and growing scrutiny in mid-2025, other paths were used, including cross-chain bridges and decentralized exchanges, to move and convert funds.
A Freeze And A Warning
That open ledger also left the transactions visible to outside observers. On June 15, 2025, Tether blacklisted several wallets linked to the central bank and froze about $37 million in USDT, showing that stablecoins can be cut off when issuers or regulators step in. That intervention narrowed some options for on-chain liquidity.
This episode matters for two reasons. First, it shows how a state institution can use stablecoins to gain access to dollar value when normal banking routes are closed.
Second, it highlights a weakness: if a private issuer can freeze balances, those reserves are not the same as cash held in hard foreign accounts.
Trade, Sanctions, And A New Tool
Reports note the purchases likely served a twin goal — to smooth domestic exchange rates and to help settle trade with partners who avoid direct dollar banking.
The method is blunt. It gives a way to move value, but it also creates new points of control and exposure that can be tracked on public ledgers.
Analysts will be watching how regulators and stablecoin issuers respond. They will also track whether other countries under pressure turn to similar mixes of centralized and decentralized tools.
The public tracing of these flows makes it harder to hide big moves, even when actors try to obscure them across chains and exchanges.
Featured image from Unsplash, chart from TradingView
Unidentified hackers disrupted Iranian state television to broadcast messages from exiled Crown Prince Reza Pahlavi. Read about the economic crisis, the internet blackout, and the latest reports on the protest death toll.
The phishing campaign targeted users on WhatsApp, including an Iranian-British activist, and stole the credentials of a Lebanese cabinet minister and at least one journalist.
A new report from blockchain analytics firm Chainalysis shows that Iran’s crypto ecosystem boomed in 2025, with Bitcoin playing a growing central role for both ordinary citizens seeking financial refuge and the Islamic Revolutionary Guard Corps (IRGC), which now dominates much of the country’s on-chain activity.
According to the report, Iran’s crypto economy processed more than $7.78 billion in value in 2025, growing faster for most of the year than in 2024.
The report found that crypto activity in Iran is closely correlated with major political shocks, regional conflict, and domestic unrest, making blockchain data a real-time barometer of instability inside the country.
Bitcoin as a flight to safety
One of the clearest trends identified in the report is a surge in Bitcoin withdrawals to personal wallets during mass protests in late 2025 and early 2026. Comparing activity before protests began with the period leading up to Iran’s nationwide internet blackout on January 8, Chainalysis observed sharp increases in both transaction volumes and transfers from Iranian exchanges to self-custodied Bitcoin wallets.
The behavior suggests Iranians are using Bitcoin as a flight to safety amid accelerating currency collapse and political uncertainty.
The Iranian rial has lost roughly 90% of its value since 2018, with inflation running between 40% and 50%. In that environment, Bitcoin’s censorship resistance and portability offer a rare form of financial optionality — especially during protests, capital controls, or the risk of needing to flee the country.
Chainalysis notes that this pattern mirrors Bitcoin adoption during crises elsewhere, where citizens turn to self-custody when trust in state-controlled financial systems breaks down.
The report shows pronounced spikes in Iranian crypto activity following major geopolitical and domestic events, including, the January 2024 Kerman bombings, which killed nearly 100 people at a memorial for IRGC-Quds Force commander Qasem Soleimani.
The report also marked a spike in activity after Iran’s October 2024 missile strikes against Israel, following the assassinations of Hamas and Hezbollah leaders and during the 12-day war in June 2025, which included the U.S.-Israeli strikes on Iranian military infrastructure, cyberattacks on Iran’s largest crypto exchange Nobitex, and disruptions at Bank Sepah, a key IRGC-linked financial institution.
IRGC is dominating Iran’s crypto economy
While Bitcoin has become a lifeline for many civilians, Chainalysis warns that Iran’s crypto ecosystem is increasingly dominated by the IRGC. Addresses linked to IRGC-affiliated networks accounted for around 50% of all crypto value received in Iran in Q4 2025, a share that has steadily grown over time.
IRGC-linked wallets received more than $3 billion on-chain in 2025, up from over $2 billion in 2024.
Chainalysis said this figure is a lower-bound estimate, based only on wallets publicly identified through sanctions designations by the U.S. Treasury’s OFAC and Israel’s National Bureau for Counter Terror Financing.
The true scale is likely larger, given the use of shell companies, facilitators, and undisclosed wallets.
These networks span multiple countries and are used to move illicit oil revenues, launder funds, evade sanctions, and finance Iran’s regional proxy groups.
Iran's currency has collapsed and is now officially worth $0.
Chainalysis concluded in their report that crypto, particularly Bitcoin, is playing somewhat of a dual role in Iran: its a financial escape valve for citizens and a sanctions-evasion tool for the state and its security apparatus.
As Iran faces mounting internal dissent, economic dysfunction, and external pressure, on-chain data shows Bitcoin increasingly being used outside government control, especially during moments of crisis.
These findings underscore how Bitcoin’s permissionless design cuts both ways — serving as a lifeline for civilians facing political instability while also enabling state and paramilitary actors, reinforcing the case that Bitcoin itself is neutral infrastructure for a couple different actors.
Iran’s on-chain crypto activity surged to about $7.80 billion in 2025, driven in large part by mass protests that began in late December 2025.
According to Chainalysis, the rise reflects both ordinary people moving assets out of banks and state-linked actors shifting funds on blockchain networks.
The shift was sharp and sudden; many withdrawals moved from local exchanges into personal wallets as people looked for ways to safeguard savings.
Iran Protests Push People Toward Bitcoin
Based on reports, Bitcoin withdrawals from Iranian exchanges rose noticeably during the unrest. Some transfers happened in short, intense bursts when internet access was still available.
Many Iranians chose self custody — sending crypto to private wallets rather than keeping it on exchanges — as the rial lost value and access to traditional finance tightened.
Inflation in the country was reported at about 40–50% in recent months, which helped push more households to seek alternatives for storing value.
State Actors And Civilian Use Diverge
Chainalysis data shows complexity in the flows. Addresses linked to the Islamic Revolutionary Guard Corps were tied to roughly half of the total crypto volume received in Iran during Q4 2025.
That does not mean ordinary use did not rise — it did. But the numbers point to crypto serving different roles at once: it can be a shelter for households when local currency collapses, and it can be a channel for state-linked actors to move funds. Analysts warn that these two uses can mask one another in on-chain tallies.
Daily crypto transfers and total transaction volumes have jumped sharply during periods of unrest in Iran.
Source: Chainalysis
Economic Fear Meets Practical Steps
People acted quickly. When banks and payment systems were uncertain or blocked, crypto offered a way to move value across borders without the usual banking rails.
Some transfers were small. Others were larger, tied to families or businesses trying to protect capital. According to the sources, these spikes in activity coincided with other significant occurrences involving geopolitical crises and specific cyber attacks that contributed to the erosion of faith in the local infrastructure.
Internet Blackouts Drive Self Custody
The Iranian government has imposed internet blackouts in response to the escalating protests. By controlling the online access, Iranians resorted to the windows of opportunity to transfer money. The transfer of money to private accounts became a common practice during the online windows.
That pattern — brief but intense bursts of withdrawals — shows how people adapt quickly to changing conditions. It also explains why on-chain volume readings jumped so high in 2025.
What The Numbers Suggest
The $7.78 billion number measures on-chain crypto volume tied to Iranian activity over the year, not the market value of holdings inside the country. Based on reports, that figure captures a mix of ordinary transfers, commercial activity, and movements linked to sanctioned entities.
Featured image from Stringer/Via Reuters, chart from TradingView
Israel has deployed additional air-defense systems across several cities as of January 14 in response to growing concerns about a possible strike from Iran, according to multiple local reports. Residents in Haifa, Jerusalem, Netanya and Caesarea observed the movement and emplacement of new batteries that form part of Israel’s nationwide protection network against rocket and […]
President Trump asked Elon Musk to get Starlink working more reliably in Iran to thwart the Iranian government's Internet shutdown. Starlink operator SpaceX was apparently already working on the problem before Trump reached out to Musk.
Iran severed Internet connections and phone lines last week as the government conducted a violent crackdown on anti-government demonstrators, according to numerous reports, which say that thousands of people have been killed.
Starlink hasn't been completely disabled. The government's jamming technology has reportedly caused Starlink packet loss of anywhere from 30 to 80 percent.
EXPERT OPINION — I amclosely watching the growing size and momentum of protesters across Iran’s cities, rural areas, and pious communities who are bravely and vocally rejecting the Supreme Leader’s broken policies. They have shined a light on Khamenei’s gross mismanagement of the economy and the severe multi-year drought; his constant agitation and hostile relations with neighbors; Iran’s loss of prestige and influence with coreligionist communities in Lebanon, Iraq, and Syria; his failures against foreign attacks; and his misguided alliance with Russia against Ukraine. Even regime loyalists have begun murmuring such complaints.
Regime instability indicators and warnings are blinking. I believe Iran’s revolutionary facade is crumbling, but into an uncertain future.
The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.
As more protesters demand a better future, I am watching for evidence of leniency from their fathers, brothers, uncles, and schoolmates who work in the IRGC, the police, and even in the Basij. If such cracks appear, new non-revolutionary leaders could emerge as quickly as al-Sharaa rose to power in Syria.
Protesters, however, most likely lack experience running cities, provinces, and the federal government. New non-revolutionary leaders therefore probably would look to the U.S. for assurance and support – and right away.
If the protests produce a new Supreme Leader under a revolutionary Velāyat-e Faqih theocracy model, however, the future looks quite dark. Crackdowns would probably be quite harsh and swift, the nuclear program would most likely march on, and Tehran undoubtedly would keep funneling money and arms to trusted proxies that threaten the U.S. and Israel.
Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.
I’ve been working on Iranian issues since 1979 as an academic, diplomat, intelligence officer, and now as a professor of practice. Nothing, in my view, would stabilize the region between the Black Sea, Eastern Mediterranean, and the Persian Gulf faster than a peaceful, non-nuclear and wealthy Iran that recognizes the state of Israel and distances itself from Russia.
Most pendulums eventually swing, and I am watching for this one to swing in support of the Iranian people finally having a chance to rejoin a community of free nations that value peace, prosperity, and democracy. If non-revolutionary leaders were to emerge, the West could finally and quickly work towards restoring a genuinely peaceful future that ends Tehran's nuclear weapons program; breaks its deadly alliance with Russia; terminates its costly support to Hizballah, Hamas, and the Houthis; and welcomes Iran into the community of nations as a responsible, wealth-producing global energy partner. May the pendulum swing decisively in these directions in 2026.
All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the US Government. Nothing in the contents should be construed as asserting or implying US Government authentication of information or endorsement of the author’s views.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief, because national security is everyone’s business.
Iran’s national currency, the rial, has completely collapsed against the U.S. dollar as the country’s economic crisis worsens. The value of one rial is now worth $0.00 right now.
On the open market, one U.S. dollar now trades for roughly 1.4 million rials, a collapse that has erased decades of purchasing power and fueled widespread unrest.
The currency’s plunge isn’t new, but the pace of decline in 2025 and early 2026 has been dramatic. Sanctions remain severe, oil revenues have shrunk, and political instability has driven investors and ordinary Iranians to seek alternatives to the rial and even to the U.S. dollar.
Inflation is soaring. Prices on food, medicine and basic goods have jumped sharply, forcing many families to spend a larger share of income just to survive. The official inflation rate climbed above 42% late last year, though actual costs for staples may be higher at this point.
The economic strain has spilled into the streets. Bazaar merchants and students have taken part in protests across cities from Tehran to Isfahan and Shiraz, condemning both economic mismanagement and political repression.
In the capital of Tehran, traditional supporters of the theocratic government have openly turned against clerical leadership as conditions worsen.
These protests have led Iran to impose telecom blackouts and jam satellite services, prompting citizens to turn to offline communication tools. Bitcoin focused apps like Bitchat and Noghteha enable secure messaging via Bluetooth and mesh networks without internet access, with Noghteha specifically adapted for Iranian users.
Iran's currency has collapsed and is now officially worth $0.
Against this backdrop, Bitcoin’s profile in Iran has quietly risen. Long before the latest collapse, crypto adoption in the Middle East and North Africa was accelerating, partly as a hedge against unstable local currencies and restrictive financial systems.
In the past weeks, reports, mainly those from blockchain analysis company Chainalysis, have highlighted Bitcoin and crypto’s role in the unrest. State actors and private citizens alike have moved value through crypto channels, both to preserve savings and to evade the limitations of the rial and sanctioned banking system.
Chainalysis data shows Iranian‑linked services moved more than $4 billion out in 2024, a jump of about 70% year over year. Iranian centralized exchanges swelled with users looking to swap rials for any asset that holds value beyond the border
Industry voices are framing Bitcoin as more than a financial curiosity. Some analysts and executives point to Bitcoin as an “exit option” for Iranians who see the rial’s collapse as a failure of traditional money. These narratives emphasize Bitcoin’s fixed supply and global liquidity as shields against inflationary policies and external pressure.
Even so, obstacles remain. Iran’s government has maintained strict controls on digital finance, cracking down on unregistered mining and monitoring crypto platforms. Official policies often contradict private behavior, creating legal uncertainty for Iranians trying to use crypto as a safe haven.
It’s times like these that point to why we need bitcoin as a race. Bitcoin stands out as the tool it was created to be: resilient, borderless, free and censorship-resistant.
New research from Recorded Future reveals how Russian state hackers (BlueDelta) are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims.
Iran has been experiencing intense protests against the Islamic Republic regime in recent weeks. Authorities have responded with severe measures, including a nationwide telecoms blackout and jamming satellite services like Starlink, aimed at preventing coordination among demonstrators.
Iranians are embracing freedom tech tools; Bitchat, Noghteha, and Delta Chat for offline communication. Two of these apps trace their origins directly to Bitcoin, highlighting how technologies from this community provide practical solutions in high-stakes environments. Bitchat, built by Bitcoin pioneers Jack Dorsey and open-source developer Calle, operates over Bluetooth mesh networks and the Nostr protocol without needing an internet connection. Noghteha on the otherhand, is a closed-source fork of Bitchat, adapted for the Iranian context with full Persian/Farsi support, an enhanced user interface, and features tailored to local needs.
How Did Bitchat and Noghteha Gain Popularity?
Bitchat first gained widespread attention when Jack Dorsey announced it on X on July 6, 2025, describing it as a weekend project to explore Bluetooth mesh networks. The announcement generated immediate interest, reflected in surges on Google Trends for related searches. In September, Frank Corva wrote about Bitchat’s role in supporting Nepalese protestors during social media restrictions and unrest, where nearly 50,000 downloads occurred in a single day.
Noghteha, on the other hand, saw rapid adoption in the first week of January 2026. Before the full internet shutdown, Google Play recorded more than 70,000 downloads of Noghteha in the space of three days, with numbers likely increasing through peer-to-peer sharing, sideloading, and Bluetooth transfers afterward.
Promotion of Noghteha reached a broad audience through Iran International, an opposition satellite TV channel based outside Iran. The station, a major source of information and coordination guidance from figures like opposition leader Reza Pahlavi, broadcast details about the app.
در شرایط بحران، وقتی اینترنت قطع میشود و تماسها دیگر پاسخگو نیستند یک راه ارتباطی هنوز باقی است. «نقطهها» اپلیکیشنی برای ارتباط بدون اینترنت. pic.twitter.com/0QiDLPbRNq
The developer Nariman Gharib, a digital-political activist, released the app independently, without government or private funding, as a response to the regime’s tactics.
But Why Fork Bitchat?
The Iranian regime employs highly sophisticated information warfare tactics. As Ziya Sadr, a prominent Bitcoin researcher and former political prisoner, explains: “The regime sets up phishing attacks, creates fake download links, and uses influencers on social media to misguide people into installing malicious versions of the same app.”
This persistent threat is likely the main reason the Noghteha developer chose not to release the app as fully open-source, and perhaps it also explains the app’s release timing, just before the internet shutdown. By releasing so close to the expected blackout, there was an opportunity to distribute a new, closed-source version into as many hands as possible before the regime could interfere with downloads or seed malicious alternatives.
Noghteha remains compliant with Bitchat’s MIT license, which allows modifications and redistribution with proper attribution. This approach is an attempt to quickly protect protesters from regime sabotage.
Calle, Bitchat’s co-creator, doesn’t quite see it that way. He’s concerned about the closed-source elements, donation requests, and security risks in adversarial settings—points that are valid and hard to dispute.
warning: iranian bitchat clone raises multiple red flags:
– full clone of our code but zero attribution or credit for our work. – not open-source. the app could be spying on you without your knowledge. NEVER USE A CLOSED-SOURCE PRIVACY MESSENGER! – asks for money. bitchat is… pic.twitter.com/byLlA9Lqmo
Yet the interaction raises a worthy question: Is Bitchat cypherpunk enough to counter the regime’s potential undermining of it, where openness itself could be weaponized? In that sense, does Noghteha achieve something that Bitchat can’t, and should that be the case, can Bitchat be adapted to become more resilient against such tactics?
Ultimately, it’s inspiring to see Bitcoin gaining prominence on the international stage, alongside freedom tech tools rooted in the cypherpunk principles of privacy through cryptography. Cypherpunks and, more recently, Bitcoin developers have pioneered technologies that excel in high-stakes scenarios, empowering individuals to maintain communication and autonomy amid oppression. With many of these tools released under permissive open-source licenses like MIT, they invite cloning and repurposing to fit various needs. While closed-source adaptations introduce new risks, they also can also generate valuable lessons, potentially guiding future enhancements to better withstand information warfare tactics.
The events in Iran demonstrate how innovations from the Bitcoin ecosystem adapt and thrive, offering real support to those navigating censorship, blackouts, and repression through resilient, user-focused tools.
Editor’s Note: A Warning on Security Users should proceed with caution. Noghteha is a closed-source application. Calle, the original developer of Bitchat, has explicitly warned against using the app due to the inability to verify its code or security. However, reports from the ground indicate it is being widely and successfully used by protestors.
Iran issued a direct warning on Sunday that it will strike U.S. military assets, commercial shipping, and Israel if the United States launches any military action during the nationwide anti-government protests gripping the country. The threat was delivered by Iranian parliament speaker Mohammad Bagher Ghalibaf in a televised address. Ghalibaf told lawmakers that “in the […]
Israel placed its security apparatus on high alert on January 10 after senior officials assessed the possibility of direct U.S. intervention in Iran as nationwide anti-government protests there enter their most volatile stage in years, according to Israeli sources who spoke to Reuters. Three Israeli officials with knowledge of internal security consultations said the alert […]
Multinational naval exercises “Will for Peace 2026” began on January 10 in South Africa’s territorial waters, the Russian Embassy in South Africa confirmed in an official statement. According to the embassy, the drills are taking place from Simon’s Town, the headquarters of the South African Navy. The statement said the exercises involve naval forces from […]
EXPERT OPINION —The Iranian people are saying they want new leadership. And it’s not too hard to understand why so many merchants, university students and young people in Iran are on the streets calling for political change and an end to the current Islamic Republic rule.
It was the merchants in Tehran’s Grand Bazar that initially closed their shops because they couldn’t make a living with soaring inflation and the collapse of the national currency, the rial. Merchants in over 32 cities quickly followed suit, with university students and the public joining in protests calling for change.
This is not new for Iran. In 2009, the government ensured that incumbent Mahmood Ahmadinejad was reelected president, despite the popular opposition leader, Mir-Hossein Mousavi, having widespread support from the public, promising hope and change. The government’s heavy hand in ensuring their man was reelected, regardless of what the public wanted and voted for, understandably angered the public, resulting in Iran’s “Green Movement.” Protesters, who adopted green as the symbol of hope and change, claimed the election was rigged. When they demanded greater democracy, the rule of law, and an end to authoritarian practices, the government responded violently. Peaceful protesters were beaten, with thousands arrested and dozens killed.
In September 2022, Jina Mahsa Amini, a 22-year-old Kurdish Iranian was arrested for improperly wearing her head scarf (hijab). She died in police custody, with eyewitnesses saying she was beaten and died because of police brutality. The death of Amini resulted in nationwide protests, with Iran Human Rights reporting that at least 476 people were killed by security forces. Amnesty International reported that the Iranian police and security forces fired into groups with live ammunition and killed protesters by beating them with batons. Amini’s death gave rise to the global movement of: Women, Life, Liberty.
Since then, Iran has conducted a war against its own people, with widespread arrests of anyone protesting widespread government corruption and human rights abuses.
The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.
Today’s protests were sparked by Iran’s severe economic crisis and water shortages, but also by Iran’s humiliating defeat by Israel in its 12-day war of June 2025 and the subsequent U.S. bombing of Iran’s nuclear facilities in Natanz, Fordow, and Isfahan. This was after the people were told that Israel would never dare to attack Iran. But they did, with impunity.
The hundreds of millions of dollars spent on Iran’s nuclear program, building thousands of spinning sophisticated centrifuges, enriching uranium at 60% purity, concealed in deeply buried underground facilities -- and related scientific work— certainly contributed to Iran’s economic collapse. The resultant global sanctions imposed on Iran also contributed to the crumbling of Iran’s economy. Indeed, Iran’s long history of pursuing nuclear weapons and then claiming they ceased such a pursuit, although continuing to enrich uranium while denying IAEA access to suspect nuclear facilities ensured that the global community viewed Iran with deep suspicion and was supportive of the biting sanctions imposed on Iran. Iran’s nuclear pursuits and the resultant sanctions led to Iran’s failed economy. And it was the people who suffered when the rial lost its value.
Iranian President Masoud Pezeshkian acknowledged the legitimacy of the protesters’ complaints, while announcing the appointment of a new central bank chief.
Reportedly, 36 people have been killed during the demonstrations, with hundreds arrested and thousands on the street saying they want change.
Supreme Leader Ayatollah Ali Khamnei, in an address on Saturday, blamed foreign interference and said that “rioters must be put in their place.”
President Donald Trump had warned Iran that if Iran “violently kills peaceful protesters” the U.S. “will come to their rescue.”
What these and previous demonstrations tell us is that the people have suffered enough. They’ve taken to the street because they want change, hope and a leadership that cares for the people. The protesters carry signs saying, “the mullahs must leave Iran.” It’s clear: the government has mismanaged Iran’s economy; has made Iran a pariah nation. The Iranian theocracy, led by supreme leader Ayatollah Ali Khamenei, apparently no longer has the support of the Iranian people.
Is a democratic secular Iran possible?
The author is a former associate director of national intelligence. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. government. Nothing in the contents should be construed as asserting or implying U.S. government authentication of information or endorsement of the author’s views.
This column by Cipher Brief Expert Ambassador Joseph DeTrani was first published in The Washington Times
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
SPECIAL REPORT — In a turbulent year, one of the biggest national security stories came in the form of a document.
The administration’s National Security Strategy (NSS), released earlier this month, upends longstanding U.S. policy toward allies and adversaries alike. It ranks drug trafficking and illegal immigration as top threats to U.S. security, places a heavy emphasis on the Western Hemisphere, criticizes Europe and downplays security challenges from China and Russia.
Eight years ago, Trump's first NSS said that “China and Russia challenge American power, influence, and interests, attempting to erode American security and prosperity.” The new NSS doesn’t name Russia as a threat to the U.S. – stating instead that “strategic stability with Russia” is a goal of American policy. Europe is presented as a bigger challenge; the U.S. should “help Europe correct its current trajectory,” which the NSS says has been damaged by immigration and a risk of “civilizational erasure.”
As for China, the document focuses on economic competition – trade, infrastructure, and technology. References to Taiwan and the South China Sea come later, and they include warnings that other Asian nations must carry a greater burden; “the American military cannot, and should not have to, do this alone.”
“The north star of great-power competition with China and Russia—around which the first Trump administration built bipartisan consensus—is gone,” Rebecca Lissner, Senior Fellow for U.S. foreign policy at the Council on Foreign Relations, wrote of the new NSS. The objective now, she said, is a “mutually advantageous economic relationship with Beijing.”
Not surprisingly, European leaders were furious about the pivot to a more Russia-friendly posture, and what the European Council President called “political interference” in the affairs of Europe.
Glenn Corn, a former CIA Senior Executive, called the document’s treatment of Europe a “shock.”
“Europeans are not the enemy,” Corn toldThe Cipher Brief. “And I doubt the Russians will stand side by side with us on the battlefield and support us the way that our European partners have done.”
The new NSS won praise from at least one global capital. Kremlin spokesman Dmitry Peskov said its emphasis on restoring strategic stability with Moscow “correspond in many ways” to Russia’s own vision.
Infographic with a map of the Americas showing the areas where the United States has carried out attacks against alleged drug trafficking boats in the Caribbean Sea and the Pacific Ocean since September 2, 2025, as well as the number of people killed in these attacks, as of December 16 (Graphic by AFP via Getty Images)
Missiles on the Water
While the focus on narcotrafficking was clear from the early days of Trump’s second term, the heavy U.S. military deployments and air strikes in the Caribbean took experts by surprise. The aerial campaign began with a September missile attack on a small boat that killed 11 people; a second strike that day took the lives of two survivors who were clinging to the upturned vessel. The follow-on strike sparked criticism in Congress – including from Republicans – and charges that it might have violated maritime laws.
As of mid-December, at least 25 strikes had followed, including some in the Pacific, resulting in the deaths of more than 90 people alleged to have been smuggling drugs on the water. The Trump administration justified the attacks as necessary to stem a flow of fentanyl – which Trump labeled “a weapon of mass destruction” that has killed tens of thousands of Americans. Legal experts questioned whether passengers in these boats — even if they were found to have been carrying narcotics — could be considered enemy combatants. Others noted that fentanyl and its precursors are sourced primarily from China and Mexico — not Venezuela.
A separate question loomed, as the year wound down: were the strikes a prelude to military action against Venezuela, and its president, Nicolas Maduro?
Beyond the U.S. military buildup, there were several signs in December that a move against Venezuela may be in the offing: reports that the U.S. was exploring “day-after” scenarios in the event of Maduro’s ouster; the seizure of a Venezuelan tanker that was said to be transporting sanctioned oil to Iran; and President Trump’s December 16 announcement of a naval blockade of sanctioned oil tankers from Venezuela.
“Maduro has become the epicenter for a range of activities the U.S. is determined to roll back,” Ambassador Patrick Duddy, Former U.S. Ambassador to Venezuela, toldThe Cipher Brief. “Seizure of the oil tanker signals that the U.S. has decided to take more active measures to achieve its goals.
Infographic with a map showing the location of strikes carried by Israel against Iran since June 13, 2025, according to data reported by the ISW (Graphic by AFP) (Graphic by VALENTINA BRESCHI,SYLVIE HUSSON,OLIVIA BUGAULT/AFP via Getty Images)
The U.S. and Israel Attack Iran
It would have been unthinkable only two years ago: a U.S.-Israeli war against Iran that provoked almost no meaningful response.
The attacks came in June – Israeli strikes on Iran’s nuclear sites and military infrastructure that were followed by American airstrikes on three nuclear installations. Iran fired missiles at a U.S. base in Qatar but its overall retaliation was minimal, a consequence of earlier Israeli campaigns that weakened Iranian air defenses and its various militias in the Middle East. The 12-day war damaged elements of Iran’s nuclear program and laid bare a tectonic shift in the region: Iran and its “axis of resistance” had been badly weakened.
For decades, war-gaming scenarios had warned that any attack against Iran would carry risks of a conflagration, given the likelihood of a coordinated response from Iran, Hezbollah, Hamas and the Houthi militia in Yemen. Now the paradigm has shifted.
“The U.S. joined Israel in military operations and people thought that had been a red line in the past,” Norman Roule, a former National Intelligence Manager for Iran at ODNI, toldThe Cipher Brief. “For the nuclear negotiations and other talks going forward, Iran now has to deal with a new world where there is this precedent.”
As the year ended, Iran remained a shell of what it had been, and reports suggested its leaders were conflicted about the way forward. Would the country recognize its weaknesses and move towards a rapprochement with the West — a move that might bring sanctions relief and usher in a new security dynamic in the region? Or would hardliners carry the day, resorting to one of the last levers Iran has – its nuclear program?
“If you're in Iran, you have to make a strategic decision,” Roule said. “‘If we restart the program, will the United States and Israel attack?’ They've got to ask, ‘If we do this, will we survive?’”
U.S. President Donald Trump and Ukrainian President Volodymyr Zelensky meet in the Oval Office at the White House on February 28, 2025 in Washington, DC. (Photo by Andrew Harnik/Getty Images)
Zelensky’s Oval Office Blowup – and the Rollercoaster that Followed
For Ukraine’s President Volodymyr Zelensky, 2025 brought wild swings of fortune, on the battlefield and in the global halls of power.
An Oval Office meeting on February 28 marked the low point – the encounter during which President Trump and Vice President JD Vance berated Zelensky for what they saw as insufficient gratitude towards the U.S. and – in Trump’s words – a failure to understand that Ukraine “has no cards” in the war against Russia.
The meeting “was a horrible disappointment and almost a shock to the system,” former NATO Supreme Allied Commander General Philip Breedlove told us that day. “There was only one winner…and that is Vladimir Putin.”
But fortune’s wheel took turns in Zelensky’s favor. Trump’s subsequent meetings with Zelensky – at the Vatican in April and the June NATO summit – warmed the relationship; the NATO summit itself saw Trump pivot back toward the alliance and its support for Ukraine; and then – in a startling outburst – Trump in July turned his ire towards Russian President Vladimir Putin. “We get a lot of bull**** thrown at us by Putin,” Trump said.
Alas for Zelensky, at year’s end the pendulum looked to have swung back once more. Trump’s envoys were again pushing Russia-friendly peace proposals, which included the surrender of territory beyond what Russia has already occupied. In an interview with Politico, Trump said of Zelensky, “He’s gonna have to get on the ball and start accepting things…cause he’s losing.” It sounded like a gentler version of the treatment Zelensky had gotten on that February day in the Oval Office.
Photo by Wojtek Laski/Getty Images
A Tu-95 bomber aircraft takes off for a night patrol flies out of Engels-2 airbase on August 7, 2008 in Engels, Russia. (Photo by Wojtek Laski/Getty Images)
Operation “Spiderweb” – and What Came After
It was Ukraine’s greatest military success in 2025 – and it happened far from Ukrainian territory. An operation dubbed “Spiderweb” smuggled 117 drone weapons into Russia and unleashed them against several airfields on June 1, damaging or destroying dozens of Russian warplanes. The mission was months in the planning, the drones were smuggled on prefabricated cabins disguised as hunting lodges, and unsuspecting Russians were paid to drive the trucks that moved the cabins.
“Spiderweb” showcased Ukraine's special operations capabilities and was followed by more long-range sabotage.As The Cipher Brief reported, subsequent attacks targeted Russian refineries and other sites tied to the oil sector.
“It’s very impressive,” Balazs Jarabik, a former European Union diplomat and analyst for RPolitik, told The Cipher Brief. The energy-sector attacks, he said, were “making the Russian war effort more expensive, and creating shortages so the Russian people feel the pain of the war.”
By year’s end, Ukraine had carried out an estimated 160 strikes on Russia’s oil sector – the campaign reached as far as the Siberian city of Tyumen, some 1200 miles east of Moscow, and included strikes against vessels alleged to be working in Russia’s so-called "shadow fleet” of tankers carrying sanctioned oil.
“Ukraine’s theory of victory now includes destroying Russia’s energy sector,” Lt. Gen. Ben Hodges, a former commander of U.S. Army Forces in Europe, told The Cipher Brief. “They’ve developed capabilities that can reach great distances with precision, exposing Russia’s vulnerability – its inability to protect critical infrastructure across its vast landscape.”
Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.
Palestinians flock to the Netzarim Corridor to receive limited food supplies as hunger deepens across Gaza amid ongoing Israeli attacks and blockade, on August 4, 2025. (Photo by Hassan Jedi/Anadolu via Getty Images)
A Peace Deal for Gaza
It was President Trump’s signature diplomatic achievement: a truce in Gaza reached just days before the two-year anniversary of Hamas’ October 7, 2023 massacre.
The deal’s first phase took hold, albeit in violent fits and starts – the return of hostages, the freeing of Palestinian prisoners in Israeli jails, and a fresh flow of international aid for Gaza. But that may have been the easy part. As the year drew to a close, there were sporadic breaks in the ceasefire, and the fate of the deal’s next phases remained unclear.
The Trump administration’s plan for Gaza included the deployment of an international stabilization force and creation of an international “Board of Peace” (led by Trump himself) to oversee the implementation of the next phases – the transition of governance to Palestinians not affiliated with Hamas, and the beginning of a multi-billion-dollar reconstruction. The deal also included language offering a conditional pathway to Palestinian autonomy over its territories.
But as of mid-December, the announcement of the Board had been delayed, and the New York Timesreported that while the U.S. was pressing other nations to contribute troops to a 8,000-member force for Gaza, it had yet to win any commitments. Countries were said to be worried their troops might be ensnared in fresh fighting; and the UN Security Council resolution to deploy the force gave no precise terms of engagement. Nor was there agreement on the makeup of a transitional government.
As these hurdles appeared, reports suggested Hamas was rebuilding its presence in the territory.
“Who’s really calling the shots there?” Ralph Goff, a former CIA Senior Executive, asked at The Cipher Brief’s annual Threat Conference, speaking of the uncertainty inside Gaza. “I remain pretty pessimistic on the idea of any kind of internal governing force being able to compete with Hamas at this point.”
By year’s end, two things were clear: the Gaza ceasefire itself was a welcome achievement after two years of carnage; and uncertainty hung over the truce’s critical next phases. This was one major story that will continue to unfold — with hope but also apprehension — well into 2026.
The commissioning and flag-presenting ceremony of the Fujian, China's first aircraft carrier equipped with electromagnetic catapults, is held at a naval port in Sanya City, south China's Hainan Province, on Nov. 5, 2025. (Photo by Li Gang/Xinhua via Getty Images)
China's Military Boom
China held a “Victory Day” parade in September – its way of marking 80 years since the end of World War II – and it was above all a show of military prowess. 12,000 troops marched alongside an arsenal of newly-minted battle tanks and rocket launchers, drone weapons and hypersonic missiles, and more. It was a fitting symbol for a year in which China turbocharged its military buildup.
As The Cipher Brief reported, China took a “leap forward” in drone weaponry in 2025: a huge new “stealth endurance drone,” mosquito-sized “micro drones,” and the deployment of a new “drone mothership.” The latter, known as the Jiu Tian, was billed as the world’s largest drone carrier – an 11-ton aircraft that is itself an uncrewed aerial vehicle. According to the South China Morning Post, the Jiu Tian can hold 100 smaller UAVs and carry them more than 4,000 miles.
“They have the production, they have large inventory and now they also have the AI,” Dr. Michael Raska, a professor at the Military Transformation Programme at the S. Rajaratnam School of International Studies, toldThe Cipher Brief. “With all these combined, they have been experiencing a leap forward in the quality and quantity of all their drones.”
China also made leaps in maritime power. In November, the People’s Liberation Army Navy (PLAN) commissioned the 80,000-ton Fujian, the country’s third aircraft carrier and largest to date. A week later came news that the Sichuan, one of the world’s largest amphibious assault ships, would be ready for deployment next year.
Retired Rear Admiral Mike Studeman, a former Commander of the Office of Naval Intelligence,toldThe Cipher Brief that China had achieved its longstanding goal of building “a world-class Navy,” which had surpassed the size of the U.S. fleet.
“It's not just not in the numbers, it's in the quality,” RADM Studeman said. “These ships are modern by any standard.”
“It's impressive,” another former Rear Admiral, Mark Montgomery, toldThe Cipher Brief. “They're building a hundred merchant ships for every one we build, and two warships for every one we build.”
The Trump Administration issued an executive order in April to jumpstart the U.S. shipbuilding industry and restore “American maritime dominance,” but experts said the U.S. faces an uphill road. As The Cipher Brief reported, China is on track to have a 425-ship fleet by 2030, while the U.S. Navy currently has fewer than 300 deployable battle-force vessels – a total which may drop as aging ships are retired faster than new ones are put to water.
Police cars are seen on November 17, 2025 close to the railways that were damaged in an explosion on the rail line in Mika, next to Garwolin, central Poland, after the line presumably was targeted in a sabotage act. (Photo by Wojtek Radwanski/AFP via Getty Images)
Europe Wakes Up to the “Gray-Zone” War
2025 was the year when Europe formally recognized – and began to respond to – a growing threat from the east: the so-called “gray-zone” war attributed to Moscow.
These attacks mushroomed in 2025 – from cyberattacks to railway bombings, the cutting of undersea cables to drone incursions into Poland and the Baltic states, and more. Experts said they were designed to be difficult to trace, and non-kinetic, so as not to draw a military response; as The Cipher Briefreported, the Kremlin was likely “aiming to create disruption without triggering escalation.”
But there were also signs that European leaders were waking up to the gravity of the threat.
NATO’s Secretary General Mark Rutte warned repeatedly of the dangers, and the alliance moved to improve detection and deterrence measures.
Nations took steps of their own. Finland acquired hundreds of drone jammers and outfitted border forces with high-end drone detectors; leaders from Poland, the Czech Republic and the Baltic states said they might shoot down Russian aircraft if Moscow continued its provocations; in a September speech to the United Nations, Polish Foreign Minister Radoslaw Sikorski went so far as to warn Moscow that “if another missile or aircraft enters our space without permission, deliberately or by mistake, and gets shot down and the wreckage falls on NATO territory, please don’t come here to whine about it.”
Even nations far from the Russian frontier were waking up to the dangers; Ireland unveiled a €1.7 billion, five-year defense plan that included systems to counter drones and protect undersea cables from Russian sabotage. And in her first public speech, MI6 chief Blaise Metreweli described the gray-zone threat bluntly: “The new frontline is everywhere,” she said.
Writing in The Cipher Brief, former Senior CIA Executive Dave Pitts stressed the need “to change the risk calculation.”
“We need to think of deterrence and response as a team sport - an Article 5 mindset,” Pitts wrote. “Gray-zone attacks that go unanswered reward our adversaries and reinforce the idea that there are more gains than risk…and encourage more attacks.”
Sign up for the Cyber Initiatives Group Sunday newsletter, delivering expert-level insights on the cyber and tech stories of the day – directly to your inbox. Sign up for the CIG newsletter today.
Heavy trucks haul earth and rock at the construction site of Wubian Xiangshang Reservoir on the top of Pandao Mountain in Zhangye, China, on March 3, 2025. (Photo by Costfoto/NurPhoto via Getty Images)
America’s Rare Earth Crisis
Not long ago, rare earth minerals rarely made global headlines. 2025 was the year when that changed. And for the U.S. government, it was also the year in which rare earths took center stage.
Two basic facts underscored the urgency: rare earths are essential building blocks for everything from smart phones to home appliances to cars to all manner of military equipment and weapon systems; and China now produces an estimated 60 percent of the world’s rare earths and processes nearly 90 percent of them. The U.S. Geological Survey said that in 2024, the U.S. imported more than 95 percent of the total rare earths that it consumed.
Those realities spurred multiple U.S. efforts to change the dynamic: deals with Australia and Japan; negotiations with other resource-rich countries, including Congo, Indonesia, Kazakhstan and Malaysia; and threats to annex mineral-rich Greenland. Even the negotiations with Russia and Ukraine reportedly included plans for U.S. firms to invest in rare-earth extraction in Russia.
China’s imposition of rare-earth export restrictions only heightened the concerns – and while those were lifted as part of a deal with Washington, the message was clear: China’s rare-earths dominance now poses a huge problem for the U.S., and gives China a powerful lever in any future negotiations with Washington.
Susan Miller, a Former Assistant Director of the CIA’s China Mission Center, called the rare earth access “vital” to U.S. technology and national security.
“We democracies must do more to assure we have continuous access to these metals, and we also need to start producing more,” Miller told The Cipher Brief. “All democracies must focus on this issue; we must act now.”
Then-National Security Agency Director General Timothy Haugh, FBI Director Kash Patel, Director of National Intelligence Tulsi Gabbard, Central Intelligence Agency Director John Ratcliffe, and then-Defense Intelligence Agency Director Jeffrey Kruse appear during a Senate Committee on Intelligence Hearing on March 25, 2025 in Washington, DC. (Photo by Andrew Harnik/Getty Images)
The Overhaul of the Intelligence Community
Before his return to the White House, Donald Trump promised to remake the U.S. intelligence community (IC). “We will clean out all of the corrupt actors in our national security and intelligence apparatus,” Trump said soon after the 2024 election.“The departments and agencies that have been weaponized will be completely overhauled.”
In 2025, it was a promise he kept.
There were widespread cuts in staffing at the CIA, FBI, and the Cybersecurity and Infrastructure Security Agency (CISA), and the biggest reductions appeared to come at the Office of the Director of National Intelligence (ODNI), which coordinates the 18 agencies of the IC. Roughly 40% of ODNI staff were cut, including the elimination or consolidation of the Foreign Malign Influence Center and some cyber threat units into other agencies.
Other high-level dismissals drew particular attention: National Intelligence Council acting head Mike Collins was fired after presenting an assessment on Venezuela that contradicted the White House line; and NSA Director Gen. Timothy Haugh lost his job after Trump “influencer” Laura Loomer questioned his loyalty to the administration.
Depending who you asked, the changes were a much-needed streamlining of a bloated intelligence apparatus; a reorganization to focus less on Russia and China and more on border security and drug trafficking; or a Trump-driven retaliation against institutions and individuals he had blamed for investigations or views with which he disagreed.
The high-level firings troubled several experts. Jon Darby, a longtime NSA veteran who served as director of operations, told The Cipher Brief he was “very disheartened” by Gen. Haugh’s ouster. “We need an explanation of the underlying rationale,” he said.
Beth Sanner, a Cipher Brief expert who served as Deputy Director for National Intelligence at ODNI, warned of a broader politicization of the IC.
“The intelligence community is not like asking people to hit the easy button and the ‘I agree with you’ button,” she said. “That's not our role. Our role is to say what we think and why we think it…The intelligence community isn't always right. But when done correctly and behind closed doors, I cannot understand why anybody would say that presenting an intelligence assessment that disagreed with policy needed to stop, or was an example of deep state. It's not. And it's really important.”
All that said, the nature of the IC makes it difficult, even at the end of a tumultuous year for the various agencies, to know precisely what the impact of the “overhaul” has been – or will be in the future.
Fingers on laptop. (Photo by Silas Stein/picture alliance via Getty Images)
A Cybersecurity “Watershed”
It seemed like a headline from a science fiction journal. An artificial intelligence system had conducted a large-scale espionage operation.
But it wasn’t science fiction – or fake news. The AI giant Anthropic confirmed the first real-world case of the use of an AI system to do exactly that.
“Today marks a watershed in cybersecurity,” Jennifer Ewbank, a former Deputy Director of the Central Intelligence Agency for Digital Innovation, told The Cipher Brief. “AI has now crossed from tool to operator,” Ewbank said, “blurring the line between human intent and machine execution...a threshold has been crossed.”
Anthropic said that Chinese state-sponsored hackers had exploited its Claude AI system to carry out cyberattacks on corporations and foreign governments in September, and that the hackers had succeeded with only minimal human oversight. Anthropic’s threat intelligence chief said the campaign had targeted about 30 entities, and represented a new level of AI-enabled hacking. The hackers posed as security auditors and successfully breached several systems, accessing privileged accounts and private data before being blocked.
The good news? The number of breaches and scale of the damage appeared small, and no U.S. government agencies were compromised. But the incident gave ammunition to doomsayers who have warned of AI nightmares – and showed that AI is already a valuable tool for hackers and state-backed cyber operations.
Experts called it the latest code-red warning for securing AI systems and deploying effective cyber defenses. As Ewbank put it, “This is no longer a hypothetical threat being researched in a lab.”
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief.
OPINION — Russian President Vladimir Putin has repeatedly threatened that Russia might use nuclear weapons if its sovereignty or territory is threatened, as it enters the fourth year in its war of aggression in Ukraine. The Russian Federation has revised its nuclear doctrine and lowered the threshold for the use of nuclear weapons. And given the lethality of nuclear weapons, the use of nuclear weapons in any large-scale exchanges would kill tens or hundreds of millions of people.
The 1963 Cuban missile crisis brought us close to a nuclear war with the Soviet Union. It was the basis for President John F. Kennedy’s concern that more countries with nuclear weapons would create an unstable world with nuclear war more likely. President Kennedy feared that by 1970 there may be 10 nuclear powers instead of the four – the U.S. Soviet Union, United Kingdom and France – and by 1975 there could be as many as 10 or 20 nuclear weapons states. It would be “the greatest possible danger and hazard to contemplate – a nuclear arms race on a multipolar basis.” President Kennedy’s concerns are the concerns we have today, with the prospect of a nuclear arms race in the Middle East and in East Asia.
The Cuban missile crisis contributed to several arms control efforts, like the Limited Test Ban Treaty (1963) banning atmospheric and underwater tests and the creation of the 1968 Nuclear Non-Proliferation Treaty (NPT). Indeed, the NPT established a global framework for the 190-member counties to stop non-nuclear states from getting nuclear weapons.
There are now nine nuclear weapons states and concern that more countries will seek the resources necessary to produce their own nuclear weapons or to buy them.
In East Asia, North Korea has increased its stockpile of nuclear weapons and the ballistic missiles to deliver these weapons of mass destruction. The Korea Institute for Defense Analysis recently publicly stated that North Korea has between 127 and 150 nuclear weapons and by 2030 they will have 200 nuclear weapons. And given the likely assistance North Korea is receiving from Russia with its nuclear and missile programs, it’s possible that South Korea and Japan, threatened by a belligerent North Korea, will conclude that they need their own nuclear deterrent programs, rather than relying on U.S. extended nuclear deterrence commitments. Indeed, a recent poll in South Korea had over 70% of the people saying they needed their own nuclear weapons program, rather than relying on the U.S. nuclear umbrella.
The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.
South Korea and Japan are watching what happens to Ukraine, a sovereign country invaded by a Russia that disregarded its security guarantees to Ukraine, with the 1994 Budapest Memorandum also signed by the U.S. and the United Kingdom. Ukraine gave up its nuclear weapons for security assurances that Russia ignored. Will the U.S. and NATO be there for Ukraine this time, or should Ukraine pursue its own nuclear deterrent?
The U.S. bombing of Iranian nuclear sites Fordow, Isfahan and Natanz in June 2025 was in response to Iran’s continued enrichment of uranium at 60% or higher and Iran’s unwillingness to permit International Atomic Energy Agency monitors to inspect nondeclared suspect enrichment sites. Thus since 2003, when Iran said they ceased their nuclear weapons program, Iran has been a threshold nuclear weapons state, months away from being able to produce nuclear weapons if the U.S. and the European Union didn’t comply with Iran’s demands.
Given this reality, and if Iran produces or acquires nuclear weapons, Saudi Arabia, Turkey and Egypt would rush to create their own nuclear weapons programs. The June 2025 U.S. bombing of these nuclear sites in Iran was an effort to ensure that Iran did not go nuclear, with the likelihood that these countries would also establish their own nuclear deterrent programs.
President Kennedy’s expressed concerns about a nuclear arms race during the Cuban missile crisis in 1962 was prophetic. Sixty-three later, there is real concern by a few non-nuclear-weapon states that they would need their own nuclear weapons to address the nuclear threat from North Korea and Iran, and the rhetoric from Mr. Putin and Dmitry Medvedev, Deputy Chairman of Russia’s Security Council, who warned that Russia is prepared to use nuclear weapons if it faces defeat in Ukraine.
This column by Cipher Brief Expert Ambassador Joseph DeTrani was first published in The Washington Times
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.