FBI Arrested 12 Pentagon Employees at Once — What They Found Ins1de EXPOSED a 2-Year Operat1on
The anomaly that broke the case open was not found 1n a class1f1ed system, not flagged by an automated mon1tor1ng tool, and not produced by any counter1ntell1gence operat1on already 1n mot1on.
It was found by an analyst who was rev1ew1ng a rout1ne access report as part of a quarterly compl1ance rev1ew.
The k1nd of adm1n1strat1ve task that c1rculated through the d1v1s1on on a rotat1ng bas1s, and that most sen1or analysts delegated to jun1or staff.
Th1s one had not been delegated.
The sen1or analyst who p1cked 1t up that Tuesday morn1ng d1d so because the jun1or analyst ass1gned to the queue was out s1ck, and the report had a subm1ss1on deadl1ne.
He found the anomaly 1n the 14th l1ne of a 340 entry access log.
A c1v1l1an 1ntell1gence analyst 1n the Pentagon’s M1ddle East Pol1cy Assessment D1v1s1on had accessed 347 class1f1ed f1les over the preced1ng 8 months.
H1s pos1t1on author1zed access to reg1onal assessment products and f1n1shed 1ntell1gence summar1es.
It d1d not author1ze access to operat1onal plann1ng documents, force pos1t1on1ng packages, or the 1nfrastructure assessment f1les that compr1se the major1ty of the 347 accessed records.
The access had been flagged by the automated system as a rout1ne over-scope event.
The k1nd of flag that produced dozens of entr1es per month across the Pentagon’s access management 1nfrastructure, and that typ1cally resolved as leg1t1mate need-to-know extens1ons granted 1nformally by superv1sors w1thout proper documentat1on.
The sen1or analyst ran the resolut1on check that the automated flag requ1red.
No 1nformal author1zat1on on f1le.
No superv1sor request.
No documented project need.
The 347 accesses had occurred across 14 separate sess1ons d1str1buted over 8 months us1ng val1d credent1als dur1ng normal work1ng hours w1th no techn1cal anomaly 1n the access pathway.
The f1les accessed covered operat1onal plann1ng t1mel1nes, force pos1t1on1ng assessments for f1ve reg1onal commands, and 1nfrastructure vulnerab1l1ty analyses for US 1nstallat1ons across the M1ddle East corr1dor.
He escalated the flag at 9:47 a.
m.
By noon, a counter1ntell1gence rev1ew team was pull1ng the analyst’s full personnel f1le.
By 3:00 p.
m.
, the f1nanc1al records request had been subm1tted.
By 6:00 p.
m.
, the team work1ng the prel1m1nary 1nqu1ry had someth1ng that converted a compl1ance flag 1nto an urgent nat1onal secur1ty 1nvest1gat1on 1n the space of one meet1ng.
The c1v1l1an analyst was one of 12 Pentagon employees whose f1nanc1al prof1les, when cross-referenced aga1nst a fore1gn 1ntell1gence compensat1on database ma1nta1ned by the Treasury Department’s F1nanc1al Cr1mes Enforcement Network, showed payments traceable to the same IRG C-l1nked f1nanc1al 1nfrastructure node.
Not the same payment methodology.
Not the same amounts.
The same or1g1nat1ng node.
A fund1ng ent1ty that had been 1dent1f1ed 1n a 2020 counter1ntell1gence case as part of Iran’s external operat1ons f1nanc1al arch1tecture, subsequently dormant, now apparently act1ve aga1n and s1multaneously compensat1ng 12 1nd1v1duals work1ng 1ns1de the most sens1t1ve defense pol1cy env1ronment 1n the Un1ted States.
12 people, one handler network, one or1g1nat1ng f1nanc1al source.
The counter1ntell1gence sect1on ch1ef called her superv1sor at 6:43 p.
m.
and sa1d one sentence, “We have a penetrat1on operat1on and we don’t know how deep 1t goes.
” E1ght days.
That was the assessment that sect1on ch1ef developed for the follow1ng 4 hours.
Work1ng w1th the 1ntell1gence commun1t1es Iran desk and two NSA l1a1son off1cers who had been brought 1nto the rev1ew under emergency compartmental1zat1on protocols.
E1ght days was not der1ved from a s1ngle 1ntercept or conf1rmed operat1onal t1mel1ne.
It was an assessment bu1lt from three converg1ng 1nd1cators.
The f1rst 1nd1cator was s1gnals.
NSA retrospect1ve analys1s of Iran1an m1l1tary commun1cat1ons over the preced1ng 6 weeks showed a pattern of repos1t1on1ng act1v1ty at three a1r defense 1nstallat1ons and two forward operat1ng locat1ons 1n the reg1on.
Movements 1ncons1stent w1th rout1ne rotat1on schedules cons1stent w1th preparat1on for an offens1ve operat1on aga1nst f1xed US pos1t1ons.
The repos1t1on1ng had begun approx1mately 6 weeks earl1er.
The accelerat1on had begun 10 days ago.
The second 1nd1cator was the access pattern.
The most recent access cluster from the c1v1l1an analyst’s log, seven f1les accessed across two sess1ons 1n the preced1ng 11 days, covered US 1nstallat1on vulnerab1l1ty assessments for the same geograph1c corr1dor where Iran1an repos1t1on1ng had been observed.
The correlat1on between what had been accessed and where Iran1an forces were mov1ng was not co1nc1dental.
The th1rd 1nd1cator was f1nanc1al.
One of the 12 1dent1f1ed 1nd1v1duals had rece1ved a payment 3 weeks earl1er that was structurally d1fferent from all pr1or payments.
Larger s1ngle transfer through a d1fferent rout1ng pathway.
In the f1nanc1al 1ntell1gence un1ts exper1ence w1th fore1gn 1ntell1gence compensat1on operat1ons, that k1nd of payment structure 1nd1cated a term1nal transact1on.
A f1nal compensat1on event.
The k1nd of payment made to an asset whose operat1onal w1ndow was clos1ng.
E1ther because the operat1on was conclud1ng or because someth1ng was about to happen that would make cont1nued access unnecessary.
E1ght days.
The sect1on ch1ef’s assessment was that Iran1an forces were prepar1ng an offens1ve act1on aga1nst US reg1onal 1nstallat1ons w1th1n that w1ndow us1ng 1ntell1gence gathered through a 12 person penetrat1on network that had been operat1ng 1ns1de the Pentagon for a per1od not yet fully assessed.
The act1on was not 1mm1nent 1n the sense of hours.
It was 1mm1nent 1n the sense of days.
And the FBI had just found the network w1th e1ght of those days rema1n1ng.
The 1nvest1gat1ons central constra1nt was as severe as any the sect1on ch1ef had encountered 1n 14 years of counter1ntell1gence work.
All 12 subjects had to be 1dent1f1ed, fully assessed, and arrested 1n a s1ngle s1multaneous operat1on.
If any one of the 12 rece1ved any 1nd1cat1on, a changed behav1or from a colleague, an unusual quest1on from secur1ty, a counter1ntell1gence 1nterv1ew request, anyth1ng, the IRGC handler network would be alerted.
An alerted network would accelerate whatever operat1onal t1mel1ne was already 1n mot1on.
The sect1on ch1ef’s assessment, shared w1th the FBI d1rector’s off1ce at 8:00 p.
m.
that even1ng, was that alert1ng the network would compress an 8-day w1ndow 1nto someth1ng cons1derably shorter.
Every arrest had to happen at the same moment.
That meant the FBI needed all 12 1dent1t1es conf1rmed, all 12 locat1ons establ1shed, all 12 warrant appl1cat1ons prepared and sealed, and all 12 arrest teams pos1t1oned and ready before a s1ngle move was made aga1nst any of them.
12 subjects, 8 days, zero marg1n for part1al act1on.
The f1rst 48 hours were consumed by 1dent1f1cat1on work.
The c1v1l1an analyst whose access flag had 1n1t1ated the 1nvest1gat1on was conf1rmed as subject one w1th1n the f1rst 3 hours.
Subjects two through f1ve were 1dent1f1ed by the follow1ng morn1ng through f1nanc1al cross-referenc1ng.
Each show1ng the same IRGC node 1n the1r payment arch1tecture, each 1n a d1fferent pos1t1on w1th1n the Pentagon c1v1l1an and contracted workforce.
A defense pol1cy contractor w1th access to reg1onal command structures, a budget analyst whose portfol1o 1ncluded 1nfrastructure ma1ntenance contracts for overseas 1nstallat1ons, a commun1cat1ons techn1c1an w1th access to the secure network 1nfrastructure l1nk1ng Pentagon plann1ng d1v1s1ons to reg1onal command centers, a sen1or adm1n1strat1ve coord1nator 1n the off1ce manag1ng off1c1al travel and personnel movement for sen1or defense off1c1als.
F1ve subjects by morn1ng, Seven by the end of day two.
The f1nanc1al network was produc1ng 1dent1t1es faster than the b1ograph1cal assessment team could process them.
Each new subject requ1r1ng a full personnel f1le rev1ew, a f1nanc1al deep d1ve, an access h1story reconstruct1on, and a commun1cat1on metadata analys1s before they could be assessed as conf1rmed versus probable.
The 1nvest1gat1on’s f1rst fr1ct1on po1nt arr1ved on day three.
Subject e1ght was a sen1or contractor whose role 1n a class1f1ed program off1ce gave h1m access not just to operat1onal plann1ng documents, but to the commun1cat1on protocols used between the Pentagon and forward deployed un1ts 1n the reg1on.
The commun1cat1on protocols, the spec1f1c encrypt1on keys, transm1ss1on schedules, and authent1cat1on sequences used to 1ssue orders to forward pos1t1ons represented a category of access that, 1f transm1tted to a fore1gn 1ntell1gence
serv1ce, went beyond 1ntell1gence on what was planned and reached 1ntell1gence on how orders would be 1ssued when the plan was 1mplemented.
The assessment of what subject e1ght had accessed over the preced1ng 14 months requ1red a separate analyt1cal track staffed w1th personnel cleared for the spec1f1c commun1cat1on programs 1nvolved.
That track produced 1ts results at 11:00 p.
m.
on day three.
Subject e1ght had accessed the commun1cat1on protocol documentat1on on s1x occas1ons.
The dates of those accesses, cross-referenced aga1nst the f1nanc1al payment records, showed that four of the s1x accesses had been followed w1th1n 48 hours by a payment depos1t from the IRGC-l1nked node.
Four accesses, four payments.
The pattern was unamb1guous.
The commun1cat1on protocols for forward operat1ons 1n the reg1on were 1n Iran1an hands.
The sect1on ch1ef spent 30 m1nutes alone 1n her off1ce after rece1v1ng the day three assessment.
Then, she called the br1ef1ng 1n.
“We’re not just look1ng at what they knew,” she sa1d to the assembled team.
“We’re look1ng at what they could do w1th what they knew.
And subject e1ght g1ves them the ab1l1ty to do more than we’ve been assess1ng.
” The 1nvest1gat1on scope was rev1sed.
The e1ght-day w1ndow assessment was shortened to s1x.
Not because new 1ntell1gence had conf1rmed a closer t1mel1ne, because the commun1cat1on protocol access meant that the offens1ve preparat1on the NSA had been track1ng could be more advanced than the repos1t1on1ng data alone suggested.
S1x days rema1n1ng, the f1nanc1al 1ntell1gence team produced subjects n1ne, 10, and 11 on day four.
Through a methodology that had not been ant1c1pated when the 1nvest1gat1on began.
The payment rout1ng for subjects n1ne through 11 d1d not trace through the same IRGC node that had 1dent1f1ed the f1rst e1ght.
It traced through a parallel node, a separate f1nanc1al 1nfrastructure ent1ty operat1ng on d1fferent rout1ng pathways that appeared 1n the same 2020 counter1ntell1gence f1le as the f1rst node, but had been assessed at the t1me
as 1nact1ve.
Two nodes, not one.
The penetrat1on operat1on had been bu1lt w1th redundant f1nanc1al arch1tecture.
A pr1mary compensat1on channel and a backup channel that would rema1n funct1onal 1f the pr1mary was ever 1dent1f1ed.
The 2020 case had found both nodes.
Ne1ther had been assessed as act1vely support1ng a current operat1on at the t1me.
The current operat1on had been us1ng both s1multaneously, not as pr1mary and backup, but as parallel tracks compensat1ng d1fferent t1ers of the network.
The redundancy meant the operat1on had been des1gned to surv1ve part1al exposure.
If the f1nanc1al analysts had found only the pr1mary node, e1ght subjects would have been 1dent1f1ed.
The rema1n1ng four would have cont1nued operat1ng 1ns1de the bu1ld1ng after the arrest of the e1ght w1th no 1nd1cat1on that any part of the1r network had been touched.
Four people w1th unrestr1cted access to class1f1ed operat1onal plann1ng documents st1ll 1n place, st1ll compensated through an 1ntact secondary channel.
F1nd1ng the backup node was not part of the or1g1nal 1nvest1gat1on protocol.
It was found because one f1nanc1al analyst rev1ew1ng the compensat1on structure of subject seven not1ced a second small payment 1n the subject’s account from a d1fferent rout1ng or1g1n.
An amount small enough to look l1ke a standard bank fee, but structured 1n a way that she recogn1zed from a pr1or case as cons1stent w1th a network acknowledgement payment.
She flagged 1t.
The secondary node was 1dent1f1ed by m1dn1ght on day four.
The team had 11 subjects conf1rmed and one probable by the morn1ng of day f1ve.
The 12th 1dent1f1cat1on was the most sens1t1ve of the 12.
Subject 12 held a sen1or c1v1l1an pos1t1on 1n the off1ce of the Under Secretary of Defense for Pol1cy.
The f1nanc1al connect1on to the IRGC secondary node was conf1rmed.
The access h1story showed 23 accesses to f1les 1n the h1ghest class1f1cat1on t1er ava1lable to a c1v1l1an non-SCI cleared employee.
F1les cover1ng broad strateg1c assessments of US reg1onal posture, all1ed coord1nat1on frameworks, and the pol1cy author1zat1on arch1tecture for the operat1on currently 1n preparat1on.
Subject 12 had not accessed operat1onal deta1ls.
Subject 12 had accessed the dec1s1on-mak1ng framework, the wa1t queue, the when author1zed, and the what cond1t1on tr1ggers for the operat1on that the other 11 had been prov1d1ng tact1cal 1ntell1gence about.
Strateg1c author1zat1on arch1tecture comb1ned w1th tact1cal pos1t1on1ng 1ntell1gence from the other 11.
The p1cture be1ng assembled from all 12 access h1stor1es, taken together, covered both the operat1onal plan and the pol1t1cal cond1t1ons under wh1ch 1t would be author1zed or halted.
The sect1on ch1ef br1efed the Deputy Attorney General at 7:00 a.
m.
on day f1ve.
The meet1ng lasted 22 m1nutes.
All 12 warrant appl1cat1ons were approved for s1multaneous sealed 1ssuance.
12 arrest teams, each composed of FBI counter1ntell1gence agent and coord1nated w1th Pentagon secur1ty personnel, were author1zed for deployment.
The operat1onal order spec1f1ed a s1ngle coord1nated w1ndow.
Pre-dawn, day seven, across all 12 locat1ons s1multaneously.
Day f1ve and day s1x were log1st1cs.
12 locat1ons, some 1n the Pentagon bu1ld1ng 1tself, requ1r1ng coord1nat1on w1th the Defense Protect1ve Serv1ce that could not be d1sclosed to general Pentagon secur1ty personnel.
Some at res1dent1al addresses, requ1r1ng standard pre-dawn res1dent1al entry protocols.
One at a hotel where subject four was travel1ng for a conference, requ1r1ng coord1nat1on w1th the FBI f1eld off1ce 1n a d1fferent c1ty w1thout any advanced d1sclosure to local law enforcement.
The surve1llance teams placed on all 12 subjects dur1ng days f1ve and s1x produced one add1t1onal f1nd1ng that altered the arrest plan 48 hours before 1t was scheduled to beg1n.
Subject three, the commun1cat1ons techn1c1an, made an unscheduled tr1p on day f1ve to a park1ng structure near a government bu1ld1ng 1n northern V1rg1n1a.
The surve1llance team documented a 12-m1nute veh1cle-to-veh1cle contact w1th an 1nd1v1dual dr1v1ng a car reg1stered to a d1plomat1c fac1l1ty.
The contact 1nd1v1dual was 1dent1f1ed through fac1al recogn1t1on aga1nst embassy personnel records as a known IRGC external operat1ons off1cer operat1ng under d1plomat1c cover, a d1rect contact w1th a handler.
12 m1nutes.
Day f1ve of an e1ght-day w1ndow.
The sect1on ch1ef’s assessment of the contact’s s1gn1f1cance was 1mmed1ate.
Subject three had met w1th the handler not to pass 1nformat1on, but to rece1ve someth1ng.
Poss1bly a t1mel1ne update.
Poss1bly a commun1cat1on conf1rm1ng that the operat1onal preparat1on was proceed1ng and that the network’s access w1ndow was about to close.
The f1nanc1al term1nal payment 1dent1f1ed earl1er, the larger s1ngle transfer payment to one of the 12, was now 1nterpretable 1n a new context.
It was not s1mply a clos1ng payment.
It was advanced compensat1on for a f1nal collect1on spr1nt.
The arrest w1ndow was moved forward by 18 hours.
Pre-dawn, day s1x, 12 teams, 12 locat1ons, zero commun1cat1on between teams unt1l all were 1n pos1t1on and the go s1gnal was 1ssued s1multaneously through a s1ngle secure channel.
The go s1gnal was 1ssued at 4:47 a.
m.
All 12 subjects were 1n custody by 5:31 a.
m.
44 m1nutes from f1rst contact to f1nal conf1rmat1on.
No subject rece1ved any 1nd1cat1on of what was happen1ng before the agents were at the1r door or the1r workstat1on.
The IRGC handler who had met w1th subject three 1n the park1ng structure was 1dent1f1ed 1n the d1plomat1c records as the sole 1nd1v1dual at the d1plomat1c fac1l1ty who had been 1n d1rect contact w1th any of the 12.
He was placed under phys1cal surve1llance at 5:31 a.
m.
By 6:00 a.
m.
, the State Department had begun the formal d1plomat1c process for h1s expuls1on.
The s1multaneous nature of the operat1on meant the IRGC handler network had no warn1ng.
No subject had been able to commun1cate because no subject had known they were be1ng watched.
The handlers’ personal dev1ces showed no outbound commun1cat1on between 4:47 a.
m.
and 6:15 a.
m.
A w1ndow that co1nc1ded exactly w1th the arrest operat1on.
The network had gone dark at the moment of f1rst contact and had rece1ved no s1gnal from any of 1ts 12 assets before the IRGC off1cer’s own commun1cat1ons were placed under emergency mon1tor1ng.
The post-arrest damage assessment took 6 weeks to comp1le and 1nvolved 14 separate analyt1cal teams work1ng under str1ct compartmental1zat1on.
The class1f1ed document, when complete, ran to 340 pages.
What was d1sclosed 1n congress1onal overs1ght br1ef1ngs descr1bed the scope of what the 12 subjects had collect1vely accessed over an assessed operat1onal per1od of between 18 and 26 months.
The prec1se start date could not be establ1shed because the earl1est payment records 1n both f1nanc1al nodes predated the Pentagon’s access1ble access log arch1ve.
In that per1od, the 12 had collect1vely accessed more than 2,400 class1f1ed documents cover1ng force pos1t1on1ng, operat1onal t1mel1nes, 1nstallat1on vulnerab1l1ty prof1les, all1ed coord1nat1on frameworks, commun1cat1on protocols, and strateg1c author1zat1on arch1tecture for US operat1ons across the M1ddle East corr1dor.
The Iran1an m1l1tary repos1t1on1ng observed by NSA 1n the weeks before the arrests was assessed 1n the damage report as d1rectly 1nformed by 1ntell1gence gathered through the network.
The repos1t1on1ng was not complete at the t1me of the arrests.
Three of the f1ve repos1t1on1ng movements had been f1nal1zed.
Two rema1ned 1n progress.
The two 1ncomplete movements were halted w1th1n 72 hours of the arrests.
The assessment’s authors noted that the halt was cons1stent w1th an adversary that had lost 1ts 1ntell1gence feed and was recal1brat1ng under cond1t1ons of sudden 1nformat1on blackout.
Cons1der the vers1on where the compl1ance report w1th the 14th l1ne anomaly 1s delegated to the jun1or analyst who 1s out s1ck.
It s1ts 1n the queue.
It 1s rev1ewed the follow1ng week.
The quarterly compl1ance deadl1ne has passed.
The flag 1s logged as a delayed resolut1on and scheduled for follow-up 1n the next cycle.
Subject one cont1nues h1s access sess1ons.
Subjects two through 12 cont1nue compensated operat1ons throughout the Pentagon, 1n pol1cy off1ces, 1n commun1cat1ons 1nfrastructure, 1n adm1n1strat1ve coord1nat1on, and 1n the dec1s1on-mak1ng arch1tecture surround1ng the operat1on be1ng planned.
The two 1ncomplete Iran1an repos1t1on1ng movements are f1nal1zed.
The operat1onal preparat1on 1nformed by 14 months of deta1led 1ntell1gence from 12 sources embedded at every level of the plann1ng h1erarchy reaches 1ts conclus1on.
The operat1on that 1s be1ng planned proceeds.
But the env1ronment 1nto wh1ch 1t proceeds has been shaped by 14 months of systemat1c 1ntell1gence collect1on des1gned spec1f1cally to prepare a counter response.
The 1nstallat1on vulnerab1l1ty assessments that subject one accessed have been used to 1dent1fy the pos1t1ons of h1ghest consequence.
The commun1cat1on protocols that subject e1ght prov1ded have been used to prepare 1nterference w1th the order arch1tecture that would coord1nate the response to any act1on.
The strateg1c author1zat1on framework that subject 12 accessed has been used to map the cond1t1ons under wh1ch the operat1on could be pol1t1cally halted rather than m1l1tar1ly countered.
The 2,400 documents.
The 18 to 26 months.
The 12 people 1n 12 d1fferent pos1t1ons, each cover1ng a d1fferent p1ece of the same p1cture.
That vers1on was a compl1ance deadl1ne and one sen1or analyst who d1d not delegate away from the table.
The 12 subjects were 1nd1cted on charges cover1ng unauthor1zed access to class1f1ed nat1onal defense 1nformat1on, act1ng as unreg1stered agents of a fore1gn government, and consp1racy to prov1de mater1al support to a fore1gn 1ntell1gence serv1ce.
The cases proceeded across mult1ple court venues under sealed proceed1ngs for a per1od of 14 months before port1ons of the 1nd1ctments were made publ1c.
The IRGC external operat1ons off1cer, who had met w1th subject three 1n the park1ng structure on day f1ve, was expelled from the Un1ted States w1th1n 72 hours of the arrests under a d1plomat1c not1f1cat1on that the Iran1an government character1zed 1n a publ1c statement as a fabr1cat1on.
The State Department d1d not respond to the character1zat1on.
The compensat1on pa1d to the 12 subjects through the two IRGC f1nanc1al nodes, reconstructed from the full f1nanc1al analys1s, totaled approx1mately $2.
3 m1ll1on over the assessed operat1onal per1od.
The analyt1cal and 1nvest1gat1ve cost of the s1x-day FBI operat1on, the s1x-week damage assessment, and the 14-month prosecut1on process was not publ1cly d1sclosed.
The class1f1ed budget summary d1str1buted to the relevant overs1ght comm1ttee descr1bed 1t 1n one l1ne as substant1ally exceed1ng the network’s total compensat1on expend1ture.
The Pentagon’s access management system was rev1sed w1th1n 90 days of the arrests.
Over-scope access flags for c1v1l1an personnel were des1gnated as requ1r1ng human rev1ew w1th1n 24 hours rather than the 72-hour w1ndow that had allowed the 1n1t1al compl1ance queue to accumulate.
The rev1s1on was 1mplemented through a pol1cy update that took 11 days to draft, rev1ew, and approve.
The sen1or analyst who had pulled the quarterly compl1ance report, because h1s jun1or colleague was out s1ck, returned to h1s normal rotat1on schedule the week after the arrests.
He was not publ1cly 1dent1f1ed.
He 1s referred to 1n the class1f1ed operat1onal summary as the 1nd1v1dual whose compl1ance rev1ew 1n1t1ated the 1nvest1gat1on.
In a post-operat1onal tra1n1ng document d1str1buted to Pentagon secur1ty compl1ance off1ces, he 1s referenced as the analyst who treated a 14th l1ne access flag as worth an escalat1on call rather than a deferred resolut1on.
He processed 46 more compl1ance reports 1n the 12 months follow1ng the arrests.
None produced an escalat1on.
He checked each one case f1le summary.
12 subjects arrested s1multaneously across 12 locat1ons 1n a 44-m1nute w1ndow.
18 to 26 months of assessed operat1onal act1v1ty across two parallel IRGC f1nanc1al compensat1on nodes.
More than 2,400 class1f1ed documents accessed across all 12 access h1stor1es.
One d1rect handler contact 1dent1f1ed and expelled under d1plomat1c process.
Two parallel f1nanc1al 1nfrastructure nodes 1dent1f1ed and mapped.
Three of f1ve Iran1an m1l1tary repos1t1on1ng movements assessed as 1nformed by network 1ntell1gence to halted w1th1n 72 hours of arrests.
Damage assessment.
340 pages.
14 analyt1cal teams.
6 weeks restr1cted d1str1but1on.
One compl1ance report.
One 14th l1ne flag.
One phone call at 9:47 a.
m.
FBI focus.
