New in SpyWeek: More Tulsi Tumult, Iran Intel Conflicts, as Peace Talks Fizzle in Pakistan
Also: China mulls MANPADs for Iran, US spies contradict Trump on Tehran's missiles, DOJ attacks Russian cyber, FBI arrests Delta Force whistleblower, Orbán's UK network
Update: the Iranians refused to accept the “final” U.S. offer, Vice President Vance announced around 9:30 pm Eastern time, after 21 hours of talks in Islamabad. The sticking point, he implied, was Iran’s refusal to renounce its nuclear program.
Gabbard Gap: Seems like a week can’t go by without someone asking, “Where’s Tulsi?” On Friday the subject was raised by Mark Caputo at Axios. “President Trump sounded ready to dismiss top intelligence chief Tulsi Gabbard until he got an earful last week from one of his oldest friends and advisers, Roger Stone,” Caputo wrote. “Trump was displeased with Gabbard when she didn’t wholeheartedly endorse the Iran war during her recent testimony to Congress about threats to the U.S., according to five advisers and confidants who spoke with the president.” Thing is, “Her fellow Cabinet officials backed her, as did Stone when the president called him last week,” according to this account. So he kept her around. “’Roger sealed the deal. He saved Tulsi,’ a source familiar with Trump’s thinking told Axios.” (Inside-the-Beltway aficionados will appreciate the subtext here: Trump called Stone. The legendary Republican dirty trickster hasn’t lost a step.)
Missile Debate: Iran has “thousands” of missiles left and can retrieve launchers buried under rubble, U.S. and Israeli officials told the Wall Street Journal this week. That’s in sharp contrast to what an increasingly erratic Pete Hegseth claimed a few days ago. The “Secretary of War” told reporters that Iran’s missile program was “functionally destroyed,” with launchers and missiles “depleted and decimated and almost completely ineffective.” And yet, they persist. Sources told the Journal that Iran’s missile inventory had been “roughly halved” since the war began Feb. 28 “yet it retains thousands of Medium–and short-Range ballistic missiles that could be pulled out of hiding or retrieved from underground sites.”
Trump has been claiming that Iran has “no cards” to play in the negotiations that opened Saturday in Pakistan, but Teheran obviously feels differently. Hegsteth, too, may be on thin ice, along with Gabbard. “Pete is not speaking truth to the president,” one administration official told The Washington Post. “As a result, the president is out there repeating misleading information.” Torpedo in the water!
Chinese MANPADS for Iran? Beijing is considering sending shoulder-fired antiaircraft missiles to Iran, according to reports. Around midnight Friday CNN reported that “U.S. intelligence indicates that China is preparing to deliver new air defense systems to Iran within the next few weeks, according to three people familiar with recent intelligence assessments.” On Saturday morning the New York Times added that, “The officials said that the intelligence is not definitive that the shipment has been sent, and that there is no evidence that the Chinese missiles have yet been used against American or Israeli forces during the conflict.” But analysts said even a debate in Beijing about what would amount to a significant escalation on Iran’s behalf shows its “stake in the conflict,” the Times added. “Intelligence agencies have assessed that China is secretly taking an active stance in the war, allowing some companies to ship chemicals, fuel and components that can be used in military production to Iran for the war.”
Heart Murmurs: On Monday President Trump and CIA Director John Ratcliffe alluded to a futuristic hi-tech tool that helped the U.S. locate that downed F-15E weapons officer in Iran. It’s called “Ghost Murmur,” sources told the New York Post. “The secret technology uses long-range quantum magnetometry to find the electromagnetic fingerprint of a human heartbeat and pairs the data with artificial intelligence software to isolate the signature from background noise,” they said.
“I’m calling bullshit,” commented Seth Hettena, the erstwhile SpyWeek columnist who now writes “The After-Action Report,” a Substack focused on special operations. “Perhaps the CIA does have a tool called Ghost Murmur. Maybe it can detect faint signals from a not-too-far distance away,” wrote Hettena, a former A.P. correspondent. “But it didn’t locate the downed airman from 40 miles away as Trump suggested. Nor can it locate a heartbeat across 1,000 square miles of desert, as one of the Post’s sources claimed. Not unless the CIA has figured out how to rewrite the laws of physics.”
Joseph Votel, the retired Army general who headed the U.S. Central Command in the first Trump administration, says the president’s threat to bomb Iran back to the Stone Ages is “shocking” and advised U.S. military officers to refuse to carry out “illegal” orders for air strikes that would primarily destroy civilian infrastructure. Listen to our full, fascinating interview with Votel on the SpyTalk podcast.
CIA’s Cyber Spies: “The CIA late last year raised the status of its elite cyber espionage division, providing it more resources to analyze and disrupt digital threats, as well as amp up the agency’s own technological innovation efforts,” reports Martin Matishak at The Record. “The Center for Cyber Intelligence, which had resided within the CIA’s Directorate of Digital Innovation since 2015, was promoted to a full-fledged mission center last October by Director John Ratcliffe as part of an internal reorganization,” he added. Hopes are that the reboot will turn out better than the original, which for years has been plagued by managerial missteps and security breaches, insiders have long told SpyTalk.
Russian Cyber Here: The Justice Department announced Apr. 7 that it had launched Operation Masquerade, “a court-authorized technical disruption of Russian GRU infrastructure used to steal government, military, and critical infrastructure information.” Since “at least 2024,” the DOJ said, Russia’s GRU military intelligence cyber warriors, dubbed variously APT28, Fancy Bear, and Forest Blizzard, have “compromised routers used in homes and businesses to steal emails, passwords, and authentication tokens of high-value intelligence targets.” No mention of the so-called Solar Winds attack in 2020, in which suspected Russian SVR attackers “executed a massive supply chain attack that penetrated several U.S. government agencies, including the Department of Homeland Security, the State Department, and the Treasury.” (New York Times)
Domestic Cyber Spying: Amid increasingly heated congressional debates over curbing the power of U.S. counterintelligence agencies to track the electronic communications of Americans, the secretive federal court that oversees such matters secretly extended the life of the controversial law that permits it for another year, the New York Times reported Thursday. The law, known as Section 702, was set to expire in April, but the Foreign Intelligence Surveillance Court renewed it without any announcement in March. “The annual recertification, issued last month in a classified ruling, means that the program can continue to collect phone calls and emails through March 2027—even if Congress fails later this month to renew the statute that underlies it,” the Times said. The unnamed judge had some unnamed objections to “tools that agencies with access to the raw data—like the C.I.A., F.B.I. and National Security Agency—have created to allow analysts to process messages, according to unclassified talking points the administration sent to lawmakers in recent days,” the Times added. The CIA, meanwhile, let it be known that 702 powers helped thwart a terrorist attack on a Taylor Swift concert in 2024 and helped locate a Mexican drug cartel boss.
Hungary Eye: Experts on Russian subversion are wondering about the future of a network of far right think tanks and conservative scholars set up over the years in Britain by Moscow supplicant Viktor Orbán, should he be defeated, as expected, at the polls on Sunday. “Using Hungarian public money—funnelled through legally insulated foundations partly funded by Russian oil revenues—Orbán has built a cross-border network of populist right think tanks, journalists and activists,” Hungary watcher Dan Nolan wrote this week at Democracy for Sale. And not just in the U.K. The American “Christian writer Rod Dreher receives $8,750 a month,” Nolan wrote. ”In 2023, Dreher, a noted Orbán supporter credited with influencing JD Vance’s conversion to Catholicism, appeared at the National Conservatism conference in London alongside Jacob Rees-Mogg, Suella Braverman and Michael Gove.”
Leaks as Espionage: On Tuesday Apr. 7 the FBI arrested Courtney Williams, a member of a psychological warfare unit at Ft. Bragg, on charges of violating the (constantly misused} Espionage Act of 1919 by leaking information about sexual harassment and discrimination inside the Army’s top secret Delta Force. Investigative reporter Seth Harp, author of The Fort Bragg Cartel, a 2025 book about murders and drug trafficking at the base as well as sexual crimes, blasted the arrest as an “outrage,” calling Williams “a courageous whistleblower who exposed rampant gender discrimination and sexual harassment in the US Army’s Delta Force.” He added that, “Unlike many of my sources, she was adamant that she be quoted by name and made no attempt to conceal her identity because her actions were entirely above-board, legitimate, and admirable.”
Antifa “Terrorists” (cont’d): “When senior Western officials met in Ottawa last month to discuss potential terrorism threats in light of the U.S.-Israeli war against Iran, a top State Department counterterrorism official delivered an unexpected message,” The New York Times revealed on Thursday. “The United States was as concerned as always about Islamist terrorism, said the official, Monica A. Jacobsen … But, she told her counterparts from Europe, Canada and Australia, the Trump administration also wanted more attention on what it believed was an insidious, underestimated threat: the far left.” Ousted Attorney General Pam Bondi reportedly put “antifa,” which is not a group but a loose association of anti-Trump activists, at the top of a list of domestic leftwing organizations that allegedly pose a national security threat to the U.S. That list is not public, so nobody outside the DOJ and FBI knows who’s on it.
Wakeup Call: “You checked the weather this morning. And you just told a surveillance company where you sleep.” That’s a real-life scenario reported by Citizenlab, the University of Toronto group that monitors threats to democracy. Not just surveillance companies, of which there are countless numbers worldwide, however, are using it: “ICE, cops & foreign govs,” too, who employ an app called Webloc to “track 500m+ phones—No warrant required.”
Ukraine Underground: The documentary-filmmaker grandson of famed World War II U.S. Army Gen. George Patton got an eye-opening tour of Kyiv’s underground command-and-control centers. “You go inside, and it looks like Newark Airport on steroids,” Benjamin Patton said in a video post on X. “100 feet of LED displays with real-time statistics: tank or motorcycle, wounded or killed, North Korean or Russian, Kalashnikov or else. And real-time videos of every strike or kill. The entire country is totally synchronized. This apparatus is extraordinary, everybody knows what’s happening anywhere in the country in real-time.”
The Princess of Pyongyang: South Korea’s NIS spy agency says Kim Jong-un’s 13-year-old daughter Ju Ae is his likely successor. It cited not just “credible intelligence” on her ascension but “a recent public display of her driving a tank that was likely intended to dispel any doubts.” (Reuters)
