New in SpyWeek: Greenland Coup Planning. Really?

Welcome to SpyWeek, our weekly newsletter, where we look at news from the intersection of intelligence, foreign policy, and military operations.

TARGET: GREENLAND: Yes, the giant ice cube with more reindeer than people is now a top-tier U.S. intelligence priority.

Trump, Greenland metropolis (Western Journal)

No, it’s not the plot of a Hollywood B-movie. The Wall Street Journal reported that Director of National Intelligence Tulsi Gabbard issued a classified “collection-emphasis message” to U.S. intel chiefs, asking them to look up anyone in Greenland who might be open to Trump’s strange obsession with the frigid island. This will sound familiar to Iran and Guatemala, which suffered White House-directed CIA coups in the 1950s. “The classified message asked agencies, whose tools include surveillance satellites, communications intercepts and spies on the ground, to identify people in Greenland and Denmark who support U.S. objectives for the island,” the Journal said, which include taking it over and extracting valuable minerals. Reuters scooped Friday that Trump officials are considering offering Greenlanders an affiliation like Micronesia has with the U.S.

For context, these collection emphasis messages (CEMs) aren’t your everyday inter-office memos. The Justice Department’s Inspector General noted they’re issued rarely and typically reserved for actual crises or major developments. In the past, these have ranged from terrorist plots, to the runup to the Jan. 6 Capitol riot, to the U.S.-Mexico border crisis and beyond. Greenland’s idea of a “crisis” is whether mushers from Qeqertarsuaq and Kangerluk were sneaking mixed-breed canines into the Avannaata Qimussersua sled dog race. 

Naturally, Gabbard lost it after the Journal spilled the Arctic beans, accusing the outlet of “aiding deep-state actors” and harming American security by ... reporting news. Clearly, we’ve entered the phase of government where pointing out incompetence is considered a national security threat.

FBI BUDGET BOOMERANG:  It’s not every day that an FBI director contradicts the president’s budget request in front of Congress. But that’s exactly what happened when Kash Patel told House lawmakers Wednesday that the bureau needs more money in 2026 than what the White House has proposed. Testifying before a House panel, Patel pushed back against a planned cut of $545 million, effectively asking Congress to override President Trump’s request. “If we continue on the current trajectory outlined,” Patel told the House Appropriations Committee, “we will have to not only eliminate 1,100 vacancies currently at the FBI, I will have to fire 1,300 more.” Patel said the FBI “can’t do the mission” if the cuts go through. Writing in Substack, veteran Capitol Hill reporter Jamie Dupree calls what Patel did so unusual as to be “almost insubordinate.” Democrats couldn’t believe it. "Trump’s handpicked FBI Director just admitted that the budget requested by his Administration is not enough to meet the needs of the agency," said Rep. Rosa DeLauro, D-Conn. On Thursday, Patel, obviously having been taken to the Trump woodshed, reversed course. He told the Senate Appropriations Committee that he would “make the mission work on whatever budget we're given.” Trump’s “skinny budget,” the White House said, claimed the cuts would eliminate things like “DEI programs, pet projects of the former administration, and duplicative intelligence activities that are already effectively housed in other agencies.”

SIGNALGATE: Yes, we’re still talking about it—and we wish we weren’t. But when top national security aides text a journalist details about an imminent attack on Yemen, you’re gonna hear about it.

The Wall Street Journal reports that Defense Secretary Pete Hegseth was way more into Signal than we knew—using it for at least a dozen sensitive conversations, including tipping off foreign governments about live military ops. The former Fox News host apparently set up many of the chats himself, firing off texts from his unsecured Pentagon line and personal phone. Because what could go wrong?

Enter 404 Media, reporting that a hacker easily busted into TeleMessage—an Israeli company selling a government-modified version of Signal that the U.S. government uses to archive messages. (The hack occurred days after erstwhile National Security Advisor Michael Waltz was photographed using TeleMessage during a cabinet meeting.) The unidentified hacker snagged data related to Customs and Border Protection, the cryptocurrency giant Coinbase, and other financial institutions, but didn’t grab any cabinet-level messages.  According to the hacker, cracking the system took about 15 minutes. “It wasn’t much effort at all.” Drop Site reported that TeleMessage’s website backend exposed users’ unencrypted emails, passwords, usernames, and phone numbers to the public. Telemessage temporarily suspended its services.

Sleep tight.

TERROR LEADER KILLED:  The Indian government announced that it had eliminated a senior leader of the Pakistan-based terror group Jaish-e-Mohammad and a brother of the group’s founder. The U.S. had listed Abdul Rauf Azhar as a Specially Designated Global Terrorist and implicated Jaish-e-Mohammad in numerous terror attacks in the region, including the kidnapping, murder, and beheading of Wall Street Journal reporter Daniel Pearl. The Indian military said the airstrike that took out Azhar was launched after Pakistani terrorists killed 26 Hindu tourists at a picnic in Kashmir last month.(Jaish-e-Mohammad seeks to establish Pakistani sovereignty over Kashmir and drive India from the region.) Hostilies, including air battles, are continuing.

NSA CUTS: The National Security Agency is planning to eliminate up to 2,000 civilian jobs as part of the Trump intel community downsizing. The Record reported that the NSA, the world’s largest electronic spy agency, has been directed to cut potentially thousands of civilian employees as part of the Trump administration’s push to reduce the size of the federal government. The cuts are expected to take place by the end of the year.

Jokesters have had fun with NSA logos for decades. Unknown provenance for this one.

CIA TIES DENIED: Lawyers for Orlin Roussev, leader of a UK-based spy ring accused of large-scale espionage for Russia, claim he helped the CIA evacuate 200 personnel from Afghanistan in 2021. They say the request came through U.S. defense contractor Constellis, formerly Blackwater. The Financial Times reported that prosecutors disputed the claim, calling it “entirely incorrect” and denying Roussev acted on behalf of the U.S. government. Roussev appeared in a London court on Thursday with five others who pleaded guilty or were convicted of spying for Russia. All six face sentencing on Monday.

SPYING ON THE VATICAN: Former CIA and FBI operatives were enlisted to gather intelligence on senior Vatican officials as part of a secretive effort by conservative American Catholics to sway future papal elections, a book claims. Gareth Gore published an excerpt from his 2024 book OPUS: The Cult of Dark Money, Human Trafficking, and Right-Wing Conspiracy inside the Catholic Church, which alleges that a group called Better Church Governance, backed by conservative Catholic Napa Institute founder Tim Busch, launched the “Red Hat Report” to gather information on prominent cardinals. Critics, including Pope Francis, saw it as a covert campaign to undermine his authority and influence the conclave that elected the first American pope, Gore says.

NO HAY CARACAS-TREN DE ARAGUA LINK: Read SpyTalk Michael Isikoff’s report on the newly declassified National Intelligence Council memo that directly contradicts public comments by Director of National Intelligence Tulsi Gabbard alleging links between the Venezuelan government and the Tren de Aragua criminal gang. “Pretty appalling,” Rep. James Himes, D-Conn., the ranking Democrat on the House Intelligence Committee, told Isikoff.  The new release proves “the administration is lying about what its own intelligence community believes,” he added. Gabbard had told podcaster Megyn Kelly that the full report would show the opposite of what it actually said.

Himes called out Gabbard for lying about the findings of her own intelligence agencies on Venezuela and Tren De Aragua

CREDIT WHERE IT’S DUE: The office of the director of national intelligence gets our respect for releasing the memo under a Freedom of Information Act request by Lauren Harper of the Freedom of the Press Foundation.

CHINA’S OREJAS: The Cuban town of Bejucal, a longtime site of Cold War intrigue, is again in U.S. intelligence crosshairs. A new report from the Center for Strategic and International Studies (CSIS) reveals that the town hosts Cuba’s growing Chinese-linked signals intelligence (SIGINT) facility. CSIS identified recent commercial satellite imagery that shows what appears to be a circularly disposed antenna array (CDAA) at Bejucal, which would expand the site’s capabilities to spy on the United States and other countries in the region.  CSIS’s Ryan Berg highlighted the developments this week at the House Homeland Security Committee’s Transportation and Maritime Security Subcommittee. We told you about this issue last year.  

SPOOKED BY SPEECH:  Gil Barndollar, a Marine Reserve officer and widely published author on military and intelligence issues, says the CIA has wrongly denied him a security clearance, so much so that he’s suing the agency. Barndollar, a senior fellow at Defense Priorities, a Washington, D.C., think tank, says the CIA wrongly stated he had failed to disclose all his writing and media appearances, including four appearances on Tucker Carlson’s Fox News show. “The Plaintiff was honest, transparent, and that he fully disclosed his outside activities,” the suit states. “Furthermore, he did not have an affirmative obligation to provide additional information to the Agency about his writings without a signed Privacy Act Statement wherein the Plaintiff explicitly agrees to the collection of his First Amendment protected activities.”

CRYPTO FOR ISIS: A Springfield, Virginia, man was sentenced to more than 30 years in prison for providing material support to ISIS. Mohammed Chhipa, 35, collected and sent $185,000 to female ISIS members in Syria. The money Chhipa raised was converted to cryptocurrency and sent to Turkey, where it was smuggled to ISIS members in Syria, where it was used to finance the escape of female ISIS members from prison camps and to support ISIS fighters. Chhipa’s wife is already  “serving two decades in prison for leading an all-female Islamic State battalion that trained women and girls to use rifles and suicide vests,” The Washington Post reported.

BASEBALL SHOOTING: The House Intelligence Committee released a scathing report criticizing the FBI’s handling of the 2017 Congressional Baseball Game shooting that targeted Republican lawmakers. Based on a 3,000-page case file, the report alleges that under then-Acting Director Andrew McCabe, the FBI manipulated facts and ignored evidence to falsely frame the attack as “suicide by cop” rather than a politically motivated assassination attempt. In its press release, the report found that the “FBI withheld information from the American public that would have undermined its ‘suicide by cop’  narrative, including that there were no uniformed police present when the shooting occurred, that the FBI had handwritten notes demonstrating Hodgkinson’s political thoughts and motivations, [and that] the FBI had 15 photos taken by Hodgkinson took two months prior when he was casing the baseball practice field.”

CAMPUS SPY TRAP: An investigation by Stanford Review revealed a covert Chinese intelligence operation targeting Stanford University. Under the alias “Charles Chen,” a suspected agent of China’s Ministry of State Security (MSS) posed as a student to befriend and manipulate researchers, including one conducting sensitive work on China. 

CYBER DEFENSE UPDATE: The House Intelligence Committee held a closed briefing on Wednesday to assess the Cybersecurity Information Sharing Act of 2015, which expires in September. Officials from the FBI, NSA, DOJ, and CISA testified on how the law has helped coordinate cyber threat sharing between the private sector and government, and how adversaries have grown more dangerous in the decade since. Chairman Rick Crawford, R-Ark., stressed the need to modernize the law to match evolving threats, while Ranking Member Jim Himes, D-Conn., called for efficient, bipartisan reforms. More hearings are planned as lawmakers weigh reauthorization of the cyber defense framework.

POCKET LITTER: 

• The CIA’s former top-ranking doctor, Terry Adirim, is suing the spy agency over her firing, accusing the government of denying her due process and bowing to far-right activists who singled her out for criticism. Just days after Adirim started her job at the CIA last year, far-right commentator Ivan Raiklin accused her of being the “architect” of the Defense Department’s vaccine mandate. That’s a crime in MAGA world.

• Bryan Vorndran, the assistant director of the FBI’s Cyber Division, is expected to leave sometime in the near future. Vorndran’s departure is reportedly due to his retirement eligibility and is not connected to the various personnel moves that have taken place under President Donald Trump. 

• A federal jury decided that Israel’s NSO Group must pay WhatsApp approximately $168 million in damages after a judge ruled that it violated anti-hacking laws when 1,400 of the messaging application’s users became infected with Pegasus spyware. (Cyberscoop)

Jeff Stein contributed to this story.

Is there something we missed? Or something you would like to see more of? Send your tips, corrections, and thoughts to SpyTalk@protonmail.com.