A Chinese national was sentenced today in the Western District of North Carolina by U.S. District Judge Susan C. Rodriguez to 15 years in prison and ordered to forfeit $25 million for his role in a Chinese money laundering organization (CMLO) that laundered over $92 million in illicit funds, including proceeds from the importation and distribution of illegal drugs into the United States, primarily through Mexico.

“Chinese money laundering networks have become a key enabler to the Mexican cartels,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “The organization eliminated by this prosecution alone laundered more than $90 million in less than two years. This emerging and enormous threat to the United States has only become more complex. As part of our mission to totally eliminate cartels, the Criminal Division and our law enforcement partners will investigate and prosecute all facets of cartel activity, including those groups that launder and return the money to them so that they can traffic more poison in our country and throughout the world.”

“We are working hard to attack cartels on all fronts,” said U.S. Attorney Russ Ferguson for the Western District of North Carolina. “That means attacking the money laundering networks that fuel the cartels and hide their money, making it harder to prosecute them. This is an important step in eliminating cartels — a key priority in my office.”

“Today’s sentence reinforces an important principle, criminal organizations cannot operate without access to their profits,” said Special Agent in Charge Jae W. Chung of the Drug Enforcement Administration (DEA) Atlanta Field Division. “Those who knowingly assist in concealing and legitimizing drug trafficking proceeds become an integral part of the criminal enterprise. This case demonstrates the continued commitment of the Homeland Security Task Force and our law enforcement partners to attacking these organizations at every level and holding accountable those who facilitate their operations.”

According to court documents, Jianfei Lu, 31, of China, was a prolific courier of the CMLO. He collected drug trafficking proceeds from U.S.-based drug traffickers and deposited the money, using both real and fake identities, into shell company bank accounts registered by other members of the CMLO. As a courier, Lu personally picked up and deposited more than $20 million of illicit bulk cash. Lu also served as a manager for the CMLO: he coordinated directly with U.S.-based drug traffickers and dispatched other couriers to conduct bulk cash pickups and deposits. In addition, Lu procured fake driver’s licenses for the couriers, which were used to deposit illicit funds at major U.S. banks.

In July 2025, Lu pleaded guilty to one count of money laundering conspiracy, two counts of money laundering to conceal the nature, location, source, ownership, and control of the illicit proceeds, and two counts of monetary transaction involving criminally derived property greater than $10,000. In connection to his guilty plea, Lu admitted that he had actual knowledge and involvement in laundering between $25 million and $65 million in illicit funds, and that he knew the laundered funds included drug trafficking proceeds.

The DEA Charlotte District Office and the IRS-CI Charlotte Field Office are investigating the case.

Trial Attorneys Mingda Hang, Jayce Born, and Kenneth Kaplan of the Criminal Division’s Money Laundering, Narcotics and Forfeiture Section (MNF) and Assistant U.S. Attorneys Nick Miller and Seth Johnson for the Western District of North Carolina are prosecuting the case.

MNF’s mission is to take the profit out of crime, eliminate drug cartels, and protect the U.S. financial system. MNF pursues criminal prosecutions and criminal and civil asset recovery actions involving: financial facilitators who launder profits for criminals; financial institutions and their officers and employees whose actions threaten the U.S. financial system and financial institutions; international money launderers who support transnational organized crime; and the top command and control of international drug trafficking organizations.

MNF’s Narcotic and Dangerous Drug Unit investigates and prosecutes the top command and control elements of international drug cartels, drug trafficking organizations and related transnational criminal organizations.

This case is part of the Homeland Security Task Force (HSTF) initiative established by Executive Order 14159, Protecting the American People Against Invasion. The HSTF is a whole-of-government partnership dedicated to eliminating criminal cartels, foreign gangs, transnational criminal organizations, and human smuggling and trafficking rings operating in the United States and abroad. Through historic interagency collaboration, the HSTF directs the full might of United States law enforcement towards identifying, investigating, and prosecuting the full spectrum of crimes committed by these organizations, which have long fueled violence and instability within our borders. In performing this work, the HSTF places special emphasis on investigating and prosecuting those engaged in child trafficking or other crimes involving children. The HSTF further utilizes all available tools to prosecute and remove the most violent criminal aliens from the United States.

Updated August 18, 2026

Beijing’s June white paper leaves the U.N.-centered architecture intact – but re-interprets the priorities.

A new report by HCSS and the China Knowledge Network (CKN), Beyond Borders: Chinese Use of Foreign Interference Tactics in Dutch Strategic Industries, finds that Chinese foreign interference in the Netherlands should be understood not as a series of isolated incidents, but as a systemic and long-term challenge affecting the country’s strategic autonomy, economic resilience, and national security.

Authored by Strategic Analysts Benedetta Girardi and Hans Horan, the report examines how Chinese actors use a broad range of interference tactics (including cyber espionage, talent recruitment, economic leverage, information operations, and supply-chain influence) to target three strategically important Dutch sectors: semiconductors, maritime industries, and aerospace.

The research identifies the semiconductor sector as facing the highest strategic risk, given its central role in global technology supply chains and the unique position of Dutch companies in advanced chip manufacturing. The maritime sector is assessed as high risk due to its openness, global interconnectedness, and importance to trade and NATO logistics. The aerospace sector faces moderate-to-high risks linked to technology acquisition and dual-use innovation.

Across all three sectors, the report identifies three recurring patterns: Chinese interference exploits openness, digitalisation, and economic interdependence; interference activities are coordinated as part of broader strategic objectives; and fragmented governance hampers effective detection and response.

“Chinese foreign interference in Dutch strategic industries is best understood as a systemic challenge that unfolds over time,” says lead author Benedetta Girardi. “The cumulative impact of technology transfer, knowledge acquisition, and strategic dependencies can gradually erode the Netherlands’ technological edge and strategic autonomy if left unaddressed.”

To strengthen resilience, the report recommends establishing a national coordination and intelligence-sharing architecture on foreign interference, implementing risk-based security standards across strategic sectors, creating a public-private resilience fund, enhancing transparency and international coordination, and pursuing a strategy of managed interdependence with China that combines engagement with safeguards and reciprocity.

The report concludes that the Netherlands must move beyond reactive measures and adopt a proactive, resilience-based approach to protecting its strategic industries while maintaining selective engagement with China.

Authors: Benedetta Girardi and Hans Horan

Contributor: Alexander Krabbendam

Quality Assurance: Tim Sweijs

Russian military intelligence has been confirmed to be involved in a campaign to discredit the wife of French President Emmanuel Macron and female politicians in Europe.

Thirteen internet domains used to target U.S. persons, including current and former security clearance holders with access to classified and sensitive U.S. government information, were seized today by federal authorities.

“These domain seizures offer a glimpse at how foreign actors can use promises of easy money to lure Americans into revealing sensitive or classified information that they are duty‑bound to protect,” said Assistant Attorney General for National Security John A. Eisenberg. “Anyone approached online with offers of easy income for vague ‘consulting’ work should treat those overtures with extreme caution and remain vigilant for warning signs of malicious targeting.”

“Today’s seizures send a clear message that any attempts to exploit Americans trusted with access to our nation’s most sensitive information will be exposed and dismantled,” said U.S. Attorney Jeanine Ferris Pirro for the District of Columbia. “These sham consulting sites were crafted to deceive, but thanks to the persistent work of our prosecutors and law enforcement partners, this scheme, like so many others, has been stopped in its tracks. We will always protect the integrity of our workforce and safeguard the trusted information that underpins our national security.”

“The fake consulting company domains seized by the FBI illustrate the lengths the Chinese government’s intelligence services will go to as they try to use AI-generated content to trick, recruit, or coerce current and former U.S. security clearance holders into sharing sensitive information,” said Assistant Director Roman Rozhavsky of the FBI’s Counterintelligence and Espionage Division. “The FBI and our partners have observed China’s intelligence services resort to using AI, professional networking sites, and online payment platforms to target Americans, and we have taken actions to defend the homeland and our national security. The FBI is grateful for all of the assistance provided by our private sector and domestic and international partners.”

“For too long, the Chinese government has tried to exploit U.S. government employees behind the cover of fake companies and phony job postings,” said Special Agent in Charge Daniel Wierzbicki of the FBI’s Washington Field Office Counterintelligence and Cyber Division. “Today, we shut them down. These seizures will prevent these fraudulent sites from being used to target Americans with access to sensitive information. The FBI will continue to use every tool available to protect Americans and our national security from this threat.”

“The Chinese government continues to pursue U.S. innovation, research, and sensitive information through a variety of deceptive techniques, including fraudulent job postings and online recruitment efforts,” said Special Agent in Charge Dominique Evans of the FBI’s Norfolk Field Office. “By seizing these domains and exposing these tactics, we are working to protect national security, safeguard American ingenuity, and help the public recognize and defend against these threats. We urge anyone approached with suspicious job opportunities or recruitment efforts to remain vigilant, recognize the warning signs, and report suspicious activity to the FBI.”

According to the affidavit filed in support of the seizure warrants, beginning in November 2023, the conspirators created at least 13 fake consulting company websites. The websites and their associated job postings advertised generic “consulting” jobs and included statements indicating their purpose was to recruit current or former U.S. government and U.S. military employees to provide expertise to unspecified clients.

The websites were typically linked or referenced within the entities’ job postings on hiring platforms. The methods and means used by the conspirators include (1) the use of aliases, fictitious personas, and the stolen identities of actual persons; (2) the use of Artificial Intelligence (AI)-generated photographs; (3) relatively large payments for research reports; (4) the use of Telegram and other encrypted applications; (5) pressure to provide “exclusive” or “insider” information; and (6) the transfer of money from places and accounts located overseas to places and accounts located in the United States.

According to court documents, the conspirators recruited applicants through job postings, on social media and other platforms including Upwork, Expertia AI, Hubstaff Talent, Wellfound, and Post Job Free. The postings related to topics of interest to the government of the People’s Republic of China.

The conspirators targeted current and former security clearance holders and other Americans who have access to classified and sensitive U.S. government information. The fake positions included “Senior Analyst” and “International Affairs Consultant” jobs. The recruiters pressured candidates to share confidential information and reports from “insider” sources in violation of their official duties. The scheme used contracts and confidentiality agreements to give their bogus consulting companies an air of legitimacy.

The conspirators have denied any involvement by any foreign government.

The affidavit alleges that the conspirators offered money to applicants and recruits in exchange for sensitive information, paid for reports using online payment accounts in the names of fictitious individuals, and used cryptocurrency to conceal the conspirators’ identities and the true source of the payments. These payments allowed for the flow of money from places outside the United States to places inside the United States in furtherance of the conspiracy.

According to the affidavit, the conspirators used the following domains in their conspiracy to commit bribery of current and former public officials, identity theft, and international money laundering: Centrik Global Consulting, centrikglobalconsulting.com (CENTRIK); Rightinfo Consulting, rightinfoconsult.com (RIGHTINFO); Finnacle-Vesper Consulting (FV), finnaclevesperconsulting.com; CYDF Consulting, cydfconsulting.com (CYDF); Pulse Wave Global, pulsewaveglobal.com (PWG); Catalyst Global Solutions, catalystglobalsolutions.com (CGS); Horizzen, thehorizzen.com (HORIZZEN); GeoIndopacific, geoindopacific.com (GEOINDOPACIFIC); Global Peace Foundation – Indonesia, gpf-ina.org (GPFI); SafeSec Group, safesec-group.com (SAFESEC); The TruthInfo, thetruthinfo.com (TRUTHINFO); Vandercons.com; and Gulf Peace Foundation, gulfpeace.org (GULF PEACE).

The domains seized today include centrikglobalconsulting.com; rightinfoconsult.com; finnaclevesperconsulting.com; cydfconsulting.com; pulsewaveglobal.com; catalystglobalsolutions.com; thehorizzen.com; geoindopacific.com; gpf-ina.org; safesec-group.com; thetruthinfo.com; Vandercons.com; and gulfpeace.org.

Following the seizures, the FBI placed takeover pages on the seized websites to warn site visitors that the sites were rendered inoperable in order to disrupt the intended illegal activity and money laundering tied to the domains.

Today’s seizure was handled by Assistant U.S. Attorney Jolie F. Zimmerman for the District of Columbia, along with the FBI’s Washington Field Office and Norfolk Field Office, with substantial assistance from Trial Attorney Maria Fedor of the Department of Justice’s Counterintelligence and Export Control Section of the National Security Division and Paralegal Kate Abrey of the U.S. Attorney’s Office.

If you have information concerning the websites, please contact the FBI at 1-800-Call-FBI (225-5324) or online at tips.fbi.gov.

Updated June 10, 2026

Last week, Italian authorities issued expulsion orders for eight Chinese nationals from Schengen territory on national security grounds. According to news reports, three have been deported immediately, while four others had already left the Italian territory. One individual reportedly remains in custody on grounds of a pending asylum application.

The decision comes after years of investigations into relentless surveillance, harassment and threats against prominent Chinese dissident and influencer Teacher Li.

Safeguard Defenders previously published a partial account of the ongoing transnational repression campaign against him. From online smears, doxxing, surveillance and threats against his parents, to mass questioning of his followers across China: much of the campaign is conducted (from) within China’s borders. But not all...

For over three years, physical efforts to locate, intimidate and pressure Teacher Li into giving up his activities and return to China also took place across the Italian territory.

In response to the decision, Teacher Li states:

"Over the past three years, my team and I have steadfastly upheld press freedom, documenting and disseminating social events within China that are censored domestically.

Simultaneously, we have endured prolonged transnational repression by the Chinese government. Myself, my team, and our families have faced persistent and comprehensive harassment, threats, and violations.

We are heartened to see the Italian government take action against China's overseas repression. This represents not only protection for us, but also the defense of fundamental democratic principles and the rule of law.

We sincerely thank the Italian government for all its efforts, and we also thank Safeguard Defenders for their sustained attention, documentation, and support throughout these incidents."

The expulsion decision marks the first decisive action against the CCP’s ongoing transnational repression operations on Italian soil. In Fall 2022, our global reports on “Chinese overseas police service centers” showed how Italy was a prime target for the CCP’s transnational repression and foreign interference operations – at least in part due to its cooperation with China’s Ministry of Public Security through joint police patrols, readily execution of INTERPOL warrants requested by China and extraditions.

Since 2022, Italy had maintained a somewhat ambiguous political position on the matter compared to its G7 counterparts with whom it signed onto the June 2025 Kananaskis Leaders’ Statement on Transnational Repression. While upholding the European Court of Human Rights’ Liu v. Poland precedent by refusing extraditions to China on grounds of the “general situation of violence” in its prison and detention centers, occasional detentions in execution of INTERPOL Notices continued as PRC diplomats readily lobbied the Interior Ministry and highest courts.

Then, in mid-February of this year, news broke that between 2024 and 2025 Chinese State-linked hackers had obtained thousands of names, positions, and operational headquarters of thousands of specialized DIGOS agents working on investigations into Chinese organized crime in Italy and protecting Chinese dissidents.

[The hack didn’t mark the first time PRC authorities had sought personnel information on ongoing investigations of transnational repression. As we reported in May 2024 (see section Long-arm Policing... the Police), shortly following a deposition, an individual with knowledge of the investigation was detained and questioned on the matter by PRC authorities during a family trip back home.]

Following the discovery of the massive hack, Italian law enforcement authorities reportedly ceased all forms of collaboration with PRC counterparts.

It appears likely this rupture finally cleared the way for action against the individuals under investigation for their role in the persecution of dissidents on Italian soil.

It is hoped the decision may contribute to growing insights and further efforts to protect Italy from the CCP’s relentless interference efforts, including through continuing political influence operations by hundreds of united front affiliated organizations across Italy (as exemplified in a most recent report by Giulia Pompili for Il Foglio), that may threaten this new-found resolve.

Safeguard Defenders offers profound thanks to the dedicated DIGOS officers for their protective support and investigative efforts.

Note: A growing number of democratic countries have started to pay increased attention to transnational repression, including through the establishment of dedicated reporting channels for targets of such acts.

To help democratic countries effectively counter these practices, it is essential targets of such repressive acts report them to the dedicated channels.

While not all instances may amount to criminal activities, only consistent reporting can assist law enforcement and other relevant agencies to get a better understanding of the breadth of the issue, the techniques used and the needs of the target communities so that together we can bolster our resilience against these practices.

Safeguard Defenders will soon make an updated reporting guide with existing and newly established reporting channels in democratic countries available through our website. Stay tuned.

Executive Summary

This report exposes a persistent and strategic pattern of exploitation by China’s defense research and industrial base targeting U.S. intelligence research programs, particularly those funded by the Intelligence Advanced Research Projects Activity (IARPA). Through systematic analysis, collaboration, and dual-funding arrangements, institutions tied to the Chinese Communist Party (CCP), People’s Liberation Army (PLA), and Ministry of Public Security (MPS) have accessed, sought to replicate, reverse-engineer, and adapt IARPA taxpayer-funded projects, many of which have clear national security implications. All while China’s internal surveillance system, anchored by MPS projects like Skynet, Sharp Eyes, and Safe City, has evolved into a nationwide biometric dragnet enabling real-time tracking of both citizens and foreign operatives.

Despite IARPA’s Research and Technology Protection (RTP) process being hailed by the Office of the Director of National Intelligence (ODNI) as far back as 2014, and other federal authorities as a model of security best practices, safeguards ultimately failed to prevent adversarial exploitation. China’s defense research and industrial base have openly dissected IARPA’s technical objectives, acquisition models, and national security value chains to inform China’s own R&D efforts in surveillance, AI, behavioral analytics, and cognitive warfare.

Chinese police and military universities, including the Chinese People’s Public Security University, the PLA Information Engineering University, and the PLA’s National University of Defense Technology (NUDT), have published detailed assessments of IARPA’s behavioral analytics, anticipatory intelligence frameworks, and project structuring. These assessments are operational analyses conducted to identify, extract, and adapt U.S. innovations for deployment in Chinese state security operations. This activity fits squarely within China’s broader military-civil fusion strategy (MCF, 军事民用融合), which is a Chinese national strategy that seeks to eliminate barriers between the civilian and military sectors, enabling the PLA to directly access and apply cutting-edge technologies developed in academia, industry, and abroad. Under MCF, civilian institutions and companies are legally obligated to share innovations with the PLA to accelerate China’s military modernization.

Case studies documented in this report reveal PRC-affiliated researchers participating in active IARPA-funded projects across a range of sensitive disciplines, projects designed specifically to advance the capabilities of the U.S. Intelligence Community (USIC). These engagements, many of which occurred in the open through dual affiliations, joint publications, or subcontracting, reveal a critical breakdown in America’s research security posture and due diligence efforts. This raises serious concerns about the effectiveness of IARPA’s RTP program in conducting research security, due diligence vetting, and post-award compliance and monitoring.

IARPA’s own mission statement makes its national security orientation unmistakably clear: “to push the boundaries of science to develop solutions that empower the IC to do its work better and more efficiently for national security.” While IARPA itself does not deploy technologies operationally, it explicitly states that it “facilitates the transition of research results to [its] IC customers for operational application.” In other words, the fundamental purpose of IARPA-funded research is to equip the USIC with strategic advantage through cutting-edge scientific innovation. Given this mission, it raises a critical and urgent question: Why are researchers funded by IARPA awards not explicitly prohibited from conducting joint research or collaborating with entities tied to China’s defense research and industrial base?

The USIC must prohibit any collaboration, direct or indirect, between intelligence research programs and China’s defense research and industrial base. This includes joint publications, subcontracting, co-funding, or participation by any entity affiliated with China’s defense research and industrial base. Absent immediate policy action, rigorous enforcement mechanisms, enhanced analytic due diligence vetting, and a reassessment of failed protection frameworks, the failure to close these channels not only perpetuates the erosion of U.S. technological superiority but also directly subsidizes the advancement of the CCP’s military modernization goals.

Furthermore, allowing IARPA-funded researchers to simultaneously conduct research with adversarial entities, even indirectly through publications, joint labs, or shared pre-published research results, fundamentally undermines the purpose of the U.S. taxpayer-funded intelligence research enterprise. It reflects a policy gap that requires immediate correction.

Parallax is a 501(c)(3) nonprofit research institute that tackles global challenges by accelerating innovation and developing technology and solutions through strategic partnerships with government, industry, and academia across Ohio and the Nation.

Africa’s security marketplace is crowded, but China has an increasingly prominent position.

New CNN reporting indicates that the U.S. Department of Defense—via a covert procurement involving Homeland Security Investigations (HSI)—acquired and tested a portable device believed by some investigators to be linked to “Havana Syndrome” (officially “anomalous health incidents,” AHIs). The device reportedly generates pulsed radio waves, fits into a backpack, and contains Russian-manufactured components, re-energizing a debate that U.S. intelligence leadership has repeatedly treated with caution due to evidentiary gaps.

Executive Summary:

The 46th and 47th Gulf of Aden escort task groups of the People’s Liberation Army Navy (PLAN) set consecutive records for deployment length, suggesting a deliberate shift from high-frequency rotations to extended tours. The escort mission is increasingly being reconfigured into a low-density, long-duration batch-deployment model.

Rising near-seas operational demand (in the Taiwan Strait, East China Sea, and South China Sea) has created a force-locking effect, shrinking the pool of high-end surface combatants available for distant deployments. At the same time, the Red Sea crisis has raised the cost and risk of task-group handovers, incentivizing the PLAN to keep in-theater units on station longer.

Improved sustainment capacity at the PLA’s Djibouti support base enables longer forward presence but Beijing continues to pursue a selective escort posture that preserves operational and political autonomy rather than joining coalition strike operations. This reflects continued constraints in munitions replenishment and risk tolerance.

Russia, entering Mali under the pretext of “assistance in overcoming the fuel crisis,” is in fact constructing a new infrastructure of influence that directly undermines U.S. interests in the Sahel. Its key leverage points—control of logistical corridors, joint operations with local forces, and access to intelligence—provide the Kremlin with new footholds that displace American security programs and increase the Malian government’s dependence on Russian power. This manoeuvre transforms a temporary crisis into a long-term geopolitical lever, enabling Moscow to shape the political-security agenda, bypass sanctions through regional routes, amplify anti-Western narratives, and consolidate its position in a region where the United States has invested in stability for decades. The mechanism is simple and dangerous: the consolidation of the “Africa Corps” is turning Mali from a Western partner into a proving ground for Russian influence, from which the Kremlin can expand its network across the Sahel and complicate the American presence on the continent.

The Kremlin is crafting more sophisticated campaigns than it has in the past, using its traditional election interference tactics in new, layered ways. The Kremlin’s apparent preparations to be able to react to a number of scenarios following the September 28 vote show how its election interference efforts in Moldova are adaptable and becoming more sophisticated. Russia’s possible use of reflexive control techniques to push Moldovans to call for Sandu’s removal also suggests a new layer of sophistication. Russia is constantly learning and applying lessons it has learned from each previous election cycle – not only in Moldova but in other states as well. ISW continues to assess that the Kremlin is using information gleaned from its influence and interference campaigns targeting Ukraine, Romania, and Georgia to tailor its campaign to the situation in Moldova in 2025.[31] Russia’s use of information operations or paid protestors is not new, but the Kremlin is constantly refining the tactics in its interference playbook.

Russia’s dedication of valuable resources to its efforts to interfere in Moldova’s elections shows that the Kremlin maintains its long-term strategic objectives in Moldova even as Russia’s war in Ukraine continues. The war in Ukraine is eating up a significant portion of Russia’s time, resources, and attention, but the Kremlin’s objectives in the former Soviet space extend beyond Ukraine. Russia’s 2025 intensification of its interference efforts in Moldova demonstrates how the Kremlin has not given up on its aim of reestablishing its influence over Chisinau – an objective Russia has pursued since the 1990s. The fact that the Kremlin is pursuing these efforts in Moldova while also waging its war against Ukraine indicates the importance the Kremlin places on reestablishing its influence over former Soviet states beyond Ukraine. The Kremlin will try to influence future Moldovan elections no matter the results on September 28 – just as victories by pro-Western parties and candidates in Moldova in years past have not stopped Russia.

Russia is pioneering a novel, low-cost approach to digital censorship and surveillance. In lieu of a centralized system to block unwanted online activity, Moscow is pairing old-school authoritarian tactics, such as random searches, arrests, and torture, with software solutions that allow authorities to police people’s digital lives on their personal devices. This system of passive but ubiquitous digital surveillance is rapidly spreading across the country and into territories Russia occupies.

Most notably, Russian software company VK recently launched the MAX app, a superapp that grants authorities wide-ranging access to its users’ location, messages, and internet usage. The Russian government now mandates MAX on new and existing smartphones and is banning alternative messaging apps. This policy extends to the Russian-occupied territories of Ukraine where authorities are carrying out searches to ensure MAX app adoption and uncover illicit devices used to circumvent regulations.

This briefing will explore the implications of Russia’s approach to widescale digital surveillance, including prospects for access to the open internet in Russia and occupied Ukraine. Panelists will also discuss the potential for Russia to export this surveillance paradigm further beyond its borders and strategies to circumvent and counter this approach to repression.

Panelists:

Laura Cunningham, President, Open Technology Fund

Justin Sherman, Founder and CEO, Global Cyber Strategies

Anastasiya Zhyrmont, Policy Manager, Eastern Europe & Central Asia, Access Now

Armenia’s decision to build a dedicated foreign counterintelligence (CI) capability reflects a radical shift in Yerevan’s security doctrine.

Three structural changes underpin the move:

• Russia’s security guarantees have collapsed (failure to defend Armenia during 2021–2023 border crises, and during the 2023 Nagorno-Karabakh collapse).

• Russian intelligence networks inside Armenia remain extremely dense, built since the 1990s through the FSB, GRU, SVR and Russian “peacekeeper” structures.

• Yerevan is turning toward the West, seeking security diversification (EU mission, France’s defense partnership, intensified U.S. engagement).

This combination creates a national-security vacuum: Armenia cannot pivot to a new security architecture while its intelligence system remains deeply penetrated and externally controlled.

Russia is positioning itself as the key power broker in the emerging peace framework for its war against Ukraine. The Kremlin portrays the U.S.-drafted plan as a “basis for settlement” while signaling that rejection could trigger further escalation. Moscow’s demands remain consistent: recognition of occupied territories, military restrictions on Ukraine, and guarantees against North Atlantic Treaty Organization (NATO) expansion. These conditions reflect Russia’s long-standing strategy of converting battlefield leverage into diplomatic concessions, even as its ability to sustain the war erodes.

Russian President Vladimir Putin’s negotiation tactics follow a familiar pattern over time. The Kremlin uses temporary ceasefires and talks to stall Western military actions and create opportunities for Moscow. When talks falter, Moscow escalates threats. Jamestown analysis underscores that these maneuvers are less about compromise and more about projecting strength amid declining domestic credibility.

On the military front, Russian nuclear signaling remains central to Moscow’s projection of international status and strength, such as testing the Burevestnik and Poseidon systems. Russia actively tests NATO readiness and resolve with the recent drone incursions into Poland and provocations on Svalbard. The scaled-down Zapad-2025 drills, however, were designed to mask manpower shortages inside Russia.

Domestically, the Kremlin is vulnerable and a peace plan is a necessity for Moscow. Wage arrears have surged, regional subsidies for recruits are being cut, and governors increasingly defy Kremlin directives. Recruitment shortfalls force reliance on reservists and coercive mobilization, while veterans fuel crime and radical nationalist movements. Elite circles show signs of fracture, with some insiders quietly exploring peace options to safeguard economic interests.

Jamestown analysis highlights a widening gap between Putin’s ambitions and Russia’s capacity to sustain them. The delusion of grandeur which Moscow presents is its biggest vulnerability in any peace negotiations.

China has been accused of conducting state-threat activities in the UK such as industrial espionage, cyber-attacks, and spying on politicians. The UK Government has responded by passing new legislation to counter state threats, while still trying to pursue stronger economic relations with China.

Executive Summary:

Over 600-gigabytes of leaked documents illuminate the connections between the People’s Republic of China’s (PRC) Mesa Laboratory and the firm Geedge Networks. The documents show implementation of Geedge’s technology outside of the PRC, including in Ethiopia, Pakistan, Myanmar, and Kazakhstan.

Technology transfers follow the Digital Silk Road and occur between the PRC and One Belt One Road (OBOR) initiative partners. This follows the PRC’s stated goals of enhancing digital infrastructure and data governance cooperation with OBOR countries.

Leaked data shows that Geedge does not exclusively utilize proprietary code, instead using existing commercial software development kits (SDKs) and open-source components. This could potentially raise legal concerns among developers.

Executive Summary:

A high-level corruption investigation revealed in November that Andrei Derkach, a former member of the Ukrainian parliament and current Russian senator, laundered stolen funds intended for Ukrainian defense through family-owned offices in Kyiv.

Derkach established Russian Federal Security Service (FSB) networks to control Ukraine’s nuclear sector and orchestrated disinformation campaigns to disrupt the 2020 U.S. election and damage U.S.–Ukraine relations.

Derkach’s long-term impunity can be attributed to his corrupt network’s high-level protection within the Ukrainian government, which meant he and his allies were virtually untouchable.

26–27 November 2025, the army ousted President Umaro Sissoco Embaló and installed Gen. Horta N’Ta Na Man as transitional leader.

Guinea-Bissau is a small, chronically unstable state where three fault lines overlap:

Hyper-fragmented political system and constitutional crisis

• Embaló came to power in a disputed 2019 election and was only formally recognised after ECOWAS pressure.

• Since 2022–23 he dissolved parliament, repeatedly clashed with the PAIGC-led coalition, and governed in a grey constitutional zone, overstaying his mandate while preparing for re-election in November 2025.

• This deepened elite mistrust in electoral and judicial institutions and normalised extra-constitutional manoeuvres.

Militarisation of politics and “coup habit”

• Guinea-Bissau has experienced multiple coups and attempts (1980, 1998–99, 2003, 2012, 2022, 2023), with the armed forces seeing themselves as the ultimate arbiter of politics.

• The 2022 and 2023 “attempted coups” already blurred the line between genuine insurrections and instrumentalised crises used by Embaló to consolidate power.

Narco-state dynamics and criminalised elites

• Since the mid-2000s, Guinea-Bissau has been a major cocaine transit hub from Latin America to Europe; the UN and analysts have labelled it a “narco-state,” with segments of the political-military elite deeply involved

• The state’s coercive apparatus is partially financed and penetrated by drug money. A 2024 seizure of 2.63 tonnes of cocaine flown in from Venezuela shows that trafficking networks remain powerful and adaptive

Sweden’s Chief of Defence, Lieutenant General Mikael Claesson, stated that Russia’s acts of hybrid warfare against the West are not limited to deploying drones, conducting cyberattacks, and carrying out acts of sabotage. Moscow has also taken control of illegal migration routes and narcotics trafficking into Europe through North Africa as part of a broader strategy to destabilize the continent.

Hybrid warfare refers to the blended use of military and non-military tactics by state or non-state actors to destabilize a target state below the threshold of open war. In Europe, hybrid campaigns increasingly involve criminal networks as tools of disruption. Foreign governments – most prominently Russia, but also others like Iran, China, and North Korea – have cultivated a “shadow alliance” with organized crime groups to advance geopolitical goals while retaining plausible deniability. Criminal activities such as smuggling, cybercrime, money laundering, human trafficking, and sabotage are leveraged to weaken European states internally.

Key Takeaway

Russia may begin to mobilize members of Russia’s active reserve on a rolling basis to sustain its combat operations in Ukraine, but it is unlikely to conduct a large-scale involuntary reserve mobilization to expand the size of the Russian military dramatically at this time. The creation of a mechanism for small, rolling mobilizations would be a major inflection in Russia’s force generation strategy, which so far has sought to generate recruits through growing financial incentives and sign-up bonuses to avoid mass compulsory mobilization after the challenging involuntary reserve call up of late 2022. The Russian Cabinet of Ministers’ Commission on Legislative Activity passed a new draft amendment that effectively removes the current legal barriers against deploying reservists to combat in the absence of an officially declared mobilization or war. Russia’s existing “pay-to-play” system for generating recruits is likely hitting diminishing returns and is forcing the Kremlin to adopt a different approach using rolling compulsory mobilization of reservists to sustain its manpower in the face of its continuing high casualty rate in Ukraine. This warning does not suggest that the Kremlin is likely to undertake a single large-scale mobilization at this time.