CIA Contractor Arrested After Five Top Secret Reports Turned Up in His Girlfriend's Substack

A Washington, D.C., man working as a contractor for the CIA was arrested Friday, accused of pulling Top Secret intelligence reports that had nothing to do with his job and passing them to his girlfriend, who published them on her Substack newsletter. Ian A. Brinksman, 42, held a Top Secret clearance with access to the government's most tightly guarded material. He is charged with unlawfully transmitting national defense information, a crime that carries up to 10 years in prison (Justice Department; FBI affidavit).

The case started with the CIA itself. "Following a referral from the Agency, on Friday, October 23rd, the FBI arrested a contractor who provided services to CIA for alleged unauthorized disclosures of classified information," CIA Director John Ratcliffe said. "There is absolutely zero tolerance for leaking, and anyone who violates their oath will be held accountable and prosecuted to the fullest extent of the law" (Justice Department).

John Eisenberg, who runs the Justice Department's National Security Division, put it more bluntly: "Brinksman reached far outside his own duties to obtain some of our Nation's most closely held secrets and handed them to a romantic partner he knew intended to publish them. That is not carelessness. It is a betrayal of his oath" (Justice Department; @DOJNatSec on 𝕏).

Phone call, secret file, story

The 13-page affidavit from FBI Special Agent John Althen lays out the same rhythm five times this year. Take March 11. The Substack writer called Brinksman at 8:41 a.m. Less than half an hour later he opened a Top Secret report in a classified government database, and he opened it again at 10:01. He left the building, came back, left again. That night she called him for 14 minutes, and he came back to the facility at 8:16 p.m. and stayed until 10:01. The same day, she posted an article that a government classification official confirmed contained Top Secret information from that report (FBI affidavit).

It happened again on May 12, May 26 and July 28: a morning call, a Top Secret report opened within hours, calls from outside the building after he badged out, and a new article within one to two days. Between Aug. 24 and Oct. 1 he opened a fifth Top Secret report five separate times, and the matching article went up Oct. 5 (FBI affidavit). The agency told the FBI that none of the five reports had anything to do with his work (FBI affidavit).

Phones aren't allowed inside his workplace, and the agent says most employees leave them in their cars. The short trips out of the building, the FBI argues, gave Brinksman just enough time to walk to his car, call, and walk back. Think of a bank teller who looks up accounts he has no business touching, steps out to the parking lot, and the next morning those balances are in his girlfriend's newsletter (FBI affidavit).

The rest of the file tightens it. Phone records show more than 800 calls or attempted calls between the two so far in 2026. No more than six people viewed the newsletter from the facility between March 1 and Oct. 5, and Brinksman was the only one who read all five articles and also opened all five reports. On Oct. 10, agents found a notebook on his desk with the corners of several pages torn out (FBI affidavit).

He also helped edit her work. On March 13 she shared a Google Doc with him, and he suggested changing a line to "combat operations" before she published it that day. The government says it has not found classified material in that piece. Back in November 2025 he wrote a friend: "The lady I've been seeing is a journalist and recently went independent. So I've been helping her get that off the ground. Her venture focuses on foreign policy" (FBI affidavit).

"I also accept leaks"

The affidavit calls the writer only "Individual 1," someone who described her Substack as "her new independent publication" for "[r]eporting on Congress, War, and political economy." It quotes a September fundraising post in which she said she had "published reporting based on classified" agency assessments, and a public comment of hers: "I also accept leaks" (FBI affidavit).

Reuters matched that fundraising line to a Sept. 28 post on Capital & Empire, a newsletter run by journalist Aída Chávez, which reads: "Over the past year, I've published reporting based on classified CIA assessments that I believe the public deserves to know about" (Reuters; Capital & Empire). Chávez was The Nation's Washington correspondent and covered Congress for The Intercept (Substack profile). She did not answer Reuters, and she has not been charged.

Capital & Empire's own archive lines up with all five dates in the affidavit. It ran stories on March 11 (Bahrain bringing in anti-riot troops amid the Iran war), May 13 (a "classified CIA analysis" on whether Gulf allies would back Trump against Iran), May 28 (Israel privately pressing the U.S. to kill Iran's lead negotiator and resume strikes), July 29 (a CIA assessment on Israel's strategy toward the U.S.) and Oct. 5 (a classified CIA report on Israel's stability, co-published with Drop Site News). Most of it dealt with the U.S. war with Iran and America's closest allies in the Middle East.

Who is Brinksman

Prosecutors say he went to work for the agency in 2020 and moved in September 2022 to an outside contractor, "Company 1," as a systems integration developer, a job that, the agency says, includes moving data between classified and unclassified systems. He had signed a nondisclosure agreement as recently as Dec. 18, 2025, warning that leaking such material could cause "irreparable injury to the United States," and took classification and system security training in March and September of this year (FBI affidavit). A LinkedIn profile under his name lists jobs as a Deloitte manager and earlier as a State Department foreign service officer (Reuters), and says he served as a Navy Reserve intelligence officer (Hindustan Times). Deloitte did not respond to Reuters.

What's next

Brinksman was charged by criminal complaint in federal court in Alexandria, Virginia, under 18 U.S.C. § 793(d), part of the Espionage Act. Eisenberg said the division "will prosecute it as such." Trial attorneys Eli Ross and Kathryn DeMarco and Assistant U.S. Attorney Vito Iaia are handling the case, and the FBI's Chicago field office ran the investigation with help from Washington (Justice Department). A federal public defender representing him declined to comment (Reuters).

Attorney General Todd Blanche said the department "will continue prosecuting individuals who leak classified information and put our national security at risk" (@TheJusticeDept on 𝕏). A complaint is only the first step. To take Brinksman to trial, prosecutors will need a grand jury indictment.