CIA Contractor Developer Arrested for Allegedly Accessing 5 Unrelated Top-Secret Reports and Leaking Them to Partner's Substack

WASHINGTON

The Federal Bureau of Investigation (FBI) on the 23rd (local time) arrested Ian A. Brinksman (42, residing in Washington, D.C.), a contractor employee who provided services to the CIA, on charges of unlawful transmission of national defense information. The U.S. Department of Justice stated that immediately after Brinksman viewed Top Secret reports, articles containing the same content were published on an online outlet run by his romantic partner. The U.S. Department of Justice charged him via a criminal complaint following a search of his residence. Investigative authorities assert that the leak of classified information was not an accidental mistake, but repeated in an established pattern.

According to an affidavit released by the U.S. Department of Justice, Brinksman accessed five Top Secret reports between March and October of this year, and each time he viewed them, similar content appeared in posts published by his partner on Substack. All of the reports in question were outside the scope of his duties. He is presumed innocent until proven guilty in a court of law.

Brinksman Was a Systems Integration Developer with Top Secret/SCI Access

The U.S. Department of Justice stated that Brinksman held a Top Secret (TS) security clearance and access to Sensitive Compartmented Information (SCI). According to the complaint, he worked as an employee of a U.S. government agency located in the Eastern District of Virginia starting in 2020, and from September 2022 worked as a systems integration developer for a contractor ("Company 1") providing services to the same agency. He worked inside a Sensitive Compartmented Information Facility (SCIF) handling SCI, and his duties included moving data between classified and unclassified networks.

CIA Director John Ratcliffe stated in a release that day that the FBI arrested a "contractor who provided services to the CIA." Director Ratcliffe said the arrest took place after the CIA referred the matter to the FBI.

FBI Special Agent John W. Alsen stated in the affidavit that Brinksman signed an SCI nondisclosure agreement on December 18, 2025. The agreement included warnings that unauthorized disclosure of SCI could cause "irreparable injury" to the United States and subject him to criminal prosecution. The agent stated that Brinksman completed classification training in March 2026 and system administrator security training in September.

Investigators Allege Calls Followed Report Access, with Articles Published One to Two Days Later

Special Agent Alsen cross-referenced Brinksman's access logs, badge entry records, and phone records. The agent stated that in 2026, there were more than 800 phone calls and call attempts between the two. The first instance occurred on March 11. His partner called Brinksman at 8:41 a.m., and less than an hour later, at 9:09 a.m., he opened a report marked Top Secret ("Report 1"). On the same day, his partner posted an article with similar content on Substack. An Original Classification Authority confirmed that this article contained classified information up to the Top Secret level.

On May 12, Brinksman called his partner first, and opened Top Secret Report 2 at 11:26 a.m. the same day. According to the agent, he placed four more calls after exiting the secure facility at 12:57 p.m. His partner posted an article with similar content the following day, May 13. The same sequence repeated on May 26, and his partner published an article on May 28. On July 28, he accessed Report 4 at 10:32 a.m., and an article was posted on July 29.

Report 5 represents the longest-running sequence. Brinksman opened this report twice on August 24, once on August 25, once on August 26, and reopened it on October 1. During the same period, calls with his partner lasted 22, 45, and 20 minutes on August 24, and 12 and 30 minutes on August 25, among others. On October 1, after opening the report, he exited the facility and spoke for 47 minutes, followed by another 37-minute call in the afternoon, and his partner posted an article on October 5. An Original Classification Authority confirmed that Articles 1 through 5 all reflected classified information from the respective reports.

Special Agent Alsen stated that because employees cannot possess cell phones while working in the facility and mostly leave them in their vehicles, a brief window between viewing reports and badge re-entries was sufficient to visit a vehicle, place phone calls, and return.

Partner's Outlet Fundraising Post Promoted "Reporting Based on Classified Assessments"

According to the affidavit, Brinksman maintained an "ongoing personal relationship" with his partner. The partner operates a "new independent outlet" on Substack covering "Congress, war, and political economy." The U.S. Department of Justice stated that in a September 2026 fundraising post, this individual wrote that they had been doing "reporting based on classified assessments that we believe readers have a right to know." In a public social media post, the partner commented, "I also accept leaks."

The agent also stated that six or fewer people accessed this Substack page from within the government facility between March 1 and October 5, and aside from Brinksman, no one who viewed all five articles also had access to all five reports.

The agent also presented as evidence an email sent by Brinksman from his Gmail account to a friend on November 20, 2025. In the email, he wrote that the woman he was seeing was "a recently independent journalist" and that he was "helping her get that off the ground." This occurred before the compromised access began. The agent stated that based on this email and corporate email correspondence, investigators determined the two were in a romantic relationship.

On March 13, the partner shared editing access to a Google Doc with Brinksman, and after Brinksman sent suggestions for sentence revisions, they were marked as "resolved," the agent stated. An article regarding Middle East affairs was published that day. However, the government stated it has not yet identified classified information in that article.

In a notebook the agent observed on Brinksman's desk on October 10, several pages had torn corners. The agent cited this circumstance based on experience that individuals take notes to convey text verbatim.

Espionage Act Section 793(d) Carries Up to 10 Years in Prison

The U.S. Department of Justice charged Brinksman with violating federal law under 18 U.S.C. § 793(d)—the unlawful transmission of national defense information. This provision stipulates that anyone who lawfully has access to documents or information relating to the national defense and willfully transmits it to a person not entitled to receive it, having reason to believe it could be used to the injury of the United States or to the advantage of any foreign nation, faces a fine or up to 10 years in prison.

The case number is 1:26-mj-423. It was filed in the U.S. District Court for the Eastern District of Virginia, Alexandria Division, and U.S. Magistrate Judge William E. Fitzpatrick administered the oath for Special Agent Alsen's affidavit by telephone on the 23rd. The investigation was handled by the FBI Chicago Field Office, with assistance from the Washington Field Office. The prosecution is led by Trial Attorneys Eli Ross and Catherine DeMarco of the U.S. Department of Justice National Security Division's Counterintelligence and Export Control Section, and Assistant U.S. Attorney Vito Iaia of the U.S. Attorney's Office for the Eastern District of Virginia. Assistant U.S. Attorneys Tejpal Chawla and Stuart Allen of the U.S. Attorney's Office for the District of Columbia are providing assistance.

The U.S. Department of Justice stated, "A criminal complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt."

Attorney General Blanche, Director Patel, and Director Ratcliffe Speak with One Voice on Zero Tolerance

Attorney General Todd Blanche said, "National defense information is classified to protect the American people from bad actors around the world who wish to do us harm," adding, "The details alleged in this complaint demonstrate a contractor who made himself an exception to federal laws protecting classified information." He stated that the U.S. Department of Justice will continue to prosecute those who leak classified information and endanger national security.

FBI Director Kash Patel said, "Earlier today, the FBI arrested a government contractor after he was caught allegedly betraying his oath and leaking classified defense information." He said, "Protecting America’s secrets is a top counterintelligence priority of this FBI."

CIA Director Ratcliffe stated, "Unauthorized disclosure of classified material poses a grave risk to our national security, intelligence sources, ongoing operations, and personnel," emphasizing that "there is zero tolerance for leaks." Assistant Attorney General for National Security John A. Eisenberg said, "Brinksman went well outside the scope of his duties to obtain some of our nation’s most closely guarded secrets and passed them to his partner, knowing her intention to publish them," adding, "This was not carelessness; it was a betrayal of his oath and the American people." He stated that if proven at trial, the charges constitute a serious violation of the Espionage Act, and the National Security Division will prosecute them accordingly.

Sources (KST)

• U.S. Department of Justice Press Release (October 23): https://www.justice.gov/opa/pr/us-government-contractor-arrested-allegedly-leaking-national-defense-information
• Criminal Complaint Affidavit (Case No. 1:26-mj-423, U.S. District Court for the Eastern District of Virginia): https://www.justice.gov/opa/media/1468496/dl?inline=
• U.S. Department of Justice X Post: https://x.com/TheJusticeDept/status/2113772885412286517
• FBI Director X Post: https://x.com/FBIDirectorKash/status/2113782529199116781