China, Russia, and Iran Very Likely to Leverage Recent USG Layoffs for Human Source Targeting, Threatening US National Security
CATs: Espionage, Great Power Competition, Counterintelligence, NATSEC
KIQ: What roles do rogue actors in the U.S. defense and intelligence community play in data leaks, espionage or internal subversion?
Executive Summary
ECHO assesses that the intelligence agencies of China, Russia, and Iran will very likely exploit recent cuts in U.S. federal agencies for targeting and recruiting purposes, posing a threat to U.S. national security. This assessment stems from the following factors: (i) publicly available reports documenting recent terminations within U.S. Government (USG) agencies by the Department of Government Efficiency (DOGE), (ii) current information from the U.S. Intelligence Community (USIC) regarding foreign adversaries' intentions and geopolitical goals, and (iii) recent cases involving U.S. persons (USPERs) convicted of espionage. ECHO makes this assessment with high confidence.
ECHO's conclusion relies on the key assumption that adversarial nations continue to view conventional espionage and human intelligence campaigns as critical to achieving their objectives in the great power competition with the U.S. We further assume that former USG employees who faced termination may experience resentment, financial insecurity, or shame about their situation. It would strengthen our assessment if counterintelligence reports reveal suspicious communications between foreign intelligence services (FIS) and former USG employees. Moreover, a lack of publicly available reporting on leaked classified or sensitive information would weaken our confidence in this evaluation.
Substantiation - Sweeping Cuts to National Security Positions and Recent Espionage Efforts of Foreign Intelligence Services
Since January 2025, the newly established DOGE agency has made substantial reductions in the workforce of temporary U.S. Government (USG) personnel, resulting in layoffs of key national security staff and disruptions to the resources of various USG agencies and departments essential for the nation’s hard and soft power capabilities.
As of March 5, 2025, more than 100,000 USG employees have accepted offers for early retirement or faced termination as part of DOGE's efforts to streamline federal agencies. Reports indicate that DOGE eliminated 130 positions from the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA), which protects 16 critical infrastructure sectors crucial for national security. This wave of terminations at CISA included threat hunters, incident response team members, disabled veterans, and former private sector workers who participated in the Cyber Talent Management System, a DHS initiative aimed at recruiting cybersecurity leaders with top-secret security clearances.
By February 21, 2025, DHS had terminated 405 probationary employees under DOGE's directive, including the reductions at CISA. Reports from the Associated Press revealed that over 200 of those employees worked for the Federal Emergency Management Agency (FEMA), 50 belonged to U.S. Citizenship and Immigration Services, and 10 came from the Department’s Science and Technology Directorate.
On February 13, 2025, DOGE terminated approximately 350 employees of the National Nuclear Security Administration (NNSA), which operates within the U.S. Department of Energy and manages the nation’s nuclear arsenal. Although DOGE rescinded most of these terminations the following day, some terminated staff members either became unreachable or declined to return after their reinstatement.
According to a Central Intelligence Agency (CIA) spokesperson, as of March 6, 2025, the CIA plans to terminate an undisclosed number of junior officers and employees hired within the previous two years to align with President Trump’s federal government reduction initiative and DOGE's strategies. This announcement followed a buyout offer the agency extended to some employees in February, though the CIA has not disclosed how many accepted this offer.
On February 14, 2025, CDC officials received notifications about impending terminations that would affect approximately one-tenth of the agency’s workforce, totaling around 700 employees, according to sources who spoke to the Associated Press.
On February 21, 2025, the Department of Defense (DOD) announced its plans to terminate 5,400 probationary employees starting the following week, alongside a hiring freeze for new civilian personnel. DOD officials projected a potential workforce reduction of 5% to 8%, which could result in the termination of an estimated 35,000 to 56,000 non-uniform DOD employees from a total workforce of 700,000 documented full-time civilian employees in 2023.
Foreign intelligence services (FISs) from adversarial nation-states actively identify, target, and recruit current and former U.S. government (USG) personnel who have access to classified and sensitive national security and public safety information. Recent reports and publicly available releases from the U.S. Department of Justice (DOJ) highlight the persistent counterintelligence threats posed by foreign agents from Moscow, Tehran, and Beijing.
As of March 1, 2025, four sources familiar with U.S. intelligence on counterintelligence threats have disclosed to CNN that adversarial nations like China and Russia are ramping up their recruitment efforts aimed at USG personnel in national security roles. These sources indicate that FISs specifically instruct their agents to focus on individuals with security clearances, those recently terminated or at risk of termination, and those who have previously accessed classified or sensitive information related to U.S. critical infrastructure and government operations.
On March 6, 2025, authorities arrested two active-duty U.S. Army soldiers, Jian Zhao and Li Tian, alongside former U.S. Army soldier Ruoyu Duan, for conspiring to commit bribery and theft of U.S. government property, as well as for attempting to transmit national defense information to unauthorized individuals. According to a U.S. Department of Justice (DOJ) press release, the three intended to transmit secret and top-secret national defense information to individuals based in China. The DOJ alleges that one of the arrested individuals received payments totaling at least $15,000.
On September 11, 2024, former CIA Officer Alexander Yuk Ching Ma, who served from 1982 to 1989, received a sentence for conspiring to deliver national security defense information to the People's Republic of China (PRC). The FBI arrested Ma in 2020 after he admitted to an undercover agent that he had facilitated the transfer of classified information to PRC intelligence officers from the Shanghai State Security Bureau (SSSB). According to the U.S. DOJ press release, the SSSB initially contacted Ma in 2001, asking him to arrange a meeting with himself, a now-deceased blood relative who had also worked at the CIA, and SSSB agents. The initial three-day meeting took place in Hong Kong, where Ma and his relative exchanged a vast collection of classified materials for $50,000 in cash.
On April 29, 2024, former National Security Agency (NSA) employee Jareh Sebastian Dalke received a sentence of 262 months in prison for attempted espionage after he tried to transmit top-secret national defense information, classified as sensitive compartmented information (TS/SCI), to an agent of the Russian Federation. Unbeknownst to Dalke, this purported Russian agent actually worked as an online covert employee for the FBI. ECHO notes that Dalke's employment with the NSA, where he handled national defense information as an Information Systems Security Designer, lasted only from June 6 to July 1, 2022.
-
(U); News Article; A.J. Vicens; Mass federal layoffs will hurt cybersecurity, former top US security official says; 05 MAR 2025; available at https://www.reuters.com/technology/cybersecurity/mass-federal-layoffs-will-hurt-cybersecurity-former-top-us-security-official-2025-03-05/; last accessed 09 MAR 2025.
(U); News Article; Nicole Sganga; CBS News; Cybersecurity agency’s top recruits decimated by DOGE cuts; available at https://www.cbsnews.com/news/cybersecurity-agencys-top-recruits-doge-cuts/; last accessed 10 MAR 2025.
(U); News Article; Meg Kinnard; Associated Press; A comprehensive look at DOGE’s firings and layoffs so far; 21 FEB 2025; available at https://apnews.com/article/doge-firings-layoffs-federal-government-workers-musk-d33cdd7872d64d2bdd8fe70c28652654; last accessed 09 MAR 2025.
(U); News Article; Naomi LaChance; AlterNet; ‘Absolutely no knowledge’: Arms expert slams DOGE as Trump reverses nuclear weapons layoffs; 17 FEB 2025; available at https://www.alternet.org/trump-musk-doge-nuclear/; last accessed 07 MAR 2025.
(U); News Article; David Klepper; Associated Press; CIA lays off some recently hired officers as Trump shakes up intelligence community; 06 MAR 2025; available at https://apnews.com/article/cia-trump-ratcliffe-layoffs-doge-fbc26d2b51b51c472078cfcc5bef2de9; last accessed 10 MAR 2025.
(U) US DOJ; Press Release; Active-Duty and Former U.S. Army Soldiers Arrested for Theft of Government Property and Bribery Scheme; 06 MAR 2025; available at https://www.justice.gov/opa/pr/active-duty-and-former-us-army-soldiers-arrested-theft-government-property-and-bribery; last accessed 10 MAR 2025
(U) US DOJ; Press Release; Former CIA Officer Sentenced to 10 Years in Prison for Conspiracy to Commit Espionage; 11 SEP 2024; available at https://www.justice.gov/archives/opa/pr/former-cia-officer-sentenced-10-years-prison-conspiracy-commit-espionage; last accessed 11 MAR 2025.
(U) US DOJ; Press Release; Former NSA Employee Sentenced to Over 21 Years in Prison for Attempted Espionage; 29 APR 2024; available at https://www.justice.gov/archives/opa/pr/former-nsa-employee-sentenced-over-21-years-prison-attempted-espionage; last accessed 11 MAR 2025.
(U) CNN; Natasha Bertrand, Katie Bo Lillis, Zachary Cohen; Exclusive: US intel shows Russia and China are attempting to recruit disgruntled federal employees, sources say; 01 MAR 2025; available at https://www.cnn.com/2025/02/28/politics/us-intel-russia-china-attempt-recruit-disgruntled-federal-employees/index.html; last accessed 10 MAR 2025.
Background - Contemporary Targeting/HUMINT by FISs
Intelligence agencies, both foreign and domestic, have long relied on established psychological and psychosocial frameworks to target, recruit, and manipulate prospective sources. MICE is one of the simplest yet most effective methods for identifying potential targets—an acronym for money, ideology, coercion, and ego. Historically, foreign intelligence services (FISs) have adeptly utilized all four elements. Recent terminations, layoffs, and forced early retirements of personnel within the U.S. government, directed by DOGE, highlight the potential for increased financial strain on terminated employees and signify a substantial risk of disillusionment and disenfranchisement within the U.S. government.
After pinpointing their targets, intelligence agents employ a newer framework for developing sources called RASCLS. This acronym represents reciprocity, authority, scarcity, commitment, affinity, likeability, and social proof. For intelligence practitioners, this stage focuses on relationship development by identifying the psychosocial factors most relevant to the unique individuals involved and leveraging these factors appropriately. Historically, the FISs of Moscow, Tehran, and Beijing have strategically utilized scarcity, authority, and reciprocity to recruit and develop sources, subtly coercing targets over time to provide sensitive and classified information.
Social media and online communications have enhanced the capabilities of FISs in conducting human intelligence (HUMINT) efforts remotely. ECHO observes that the People's Republic of China (PRC) is particularly adept at leveraging online professional networking sites like LinkedIn to solicit large numbers of potential contacts. In August 2023, an alleged Chinese spy employed by the PRC's Ministry of State Security exploited LinkedIn to target individuals with possible access to sensitive, confidential, or classified information. Their solicitation methods included attempts to lure individuals to China for coercion, fake business opportunities to solicit expertise, and pay-per-detail schemes that compensated professionals for each set of details they provided about intelligence professionals. Other tactics involved offers for paid speaking engagements and academic reports to collect sensitive or confidential information to further entrap targets. FISs from Moscow and Tehran also actively engage in these tactics.
-
(U); Journal Article; Randy Burkett; Rethinking an Old Approach – An Alternative Framework for Agent Recruitment: From MICE to RASCLS; MAR 2013; Studies in Intelligence Vol.57, No. 1; available at https://www.cia.gov/resources/csi/static/9ccc45dc156271d11769e5205ec49c29/Alt-Framework-Agent-Recruitment-1.pdf; last accessed 11 MAR 2025.
(U); News Article; BBC; Gordon Corera; ‘Chinese spy’ targeted thousands over LinkedIn; 23 AUG 2023; available at https://www.bbc.com/news/uk-66599376; last accessed 11 MAR 2025.
(U); News Article; News Nation; Kellie Meyer, Zoe Lake; China using LinkedIn, Indeed to recruit spies, targeting experts in US; 06 MAR 2023; available at https://www.newsnationnow.com/cybersecurity/chinese-spies-linkedin-social-media/?ipid=promo-link-block1; last accessed 11 MAR 2025.
Outlook & Reporting
Through 2025, ECHO assesses that the intelligence agencies of China, Russia, and Iran are very likely to exploit recent cuts in U.S. federal agencies for targeting and recruiting purposes, which poses a threat to U.S. national security. Indicators that would increase the likelihood of this assessment include: (i) law enforcement and publicly available reports of an increase in foreign intelligence officers identified on online professional networking and job board websites (such as LinkedIn and Indeed); (ii) any formal announcements regarding reductions in federal counterintelligence programs within the U.S. Intelligence Community (USIC); and (iii) the identification of terminated U.S. government employees with security clearances or experience in critical infrastructure who are traveling to or around China, Russia, and Iran.
ECHO further assesses that personal and public reporting of suspicious activity, as well as suspected contacts from foreign intelligence services, will be crucial in mitigating counterintelligence threats. ECHO strongly encourages current and former U.S. government personnel to report any suspicious contacts to tips.fbi.gov.