The Record: How I Called Russian Intelligence Operations Against America — And What the Evidence Has Since Revealed

On December 11, 2016, I published a thread on Twitter that changed my life.

At the time, I was a strategic intelligence analyst with nearly twenty years of professional experience. My publicly acknowledged clients had included the Department of Defense, the Central Intelligence Agency, the Defense Intelligence Agency, and Sandia National Laboratories. I had spent my career doing one thing: applying rigorous analytical methodology to available evidence and telling customers what the data indicated — regardless of whether they wanted to hear it.

In December 2016, the data indicated something the American public had not yet fully processed. Russian intelligence services had been running a systematic operation against the American people. Not a “hack.” Not “interference” in a single election in the colloquial sense. A coordinated, multi-vector intelligence operation targeting the foundations of American democratic governance, conducted over years, through human assets as well as technical means.

While American media blathered about Hillary’s Wisconsin Emails, I got on Twitter for a digital Paul Revere’s Ride warning Americans about Russians—who weren’t just coming, they were already here, and they had just won a larger battle than anyone ever imagined.

The thread went viral within minutes. By morning, I went from 5,000 followers to 33,000. Five thousand accounts retweeted my thread. Celebrities, political strategists, and citizens alike were singing my thread’s praises. Russian assets like Glenn Greenwald were already calling me mentally ill, in true Stalinist style. And the tide began turning in Russia’s information war back toward American patriots.

But it was a real war, and those aren’t over quickly.

What the Intelligence Community confirmed — and what it got wrong

Within three weeks, the United States Intelligence Community published what became known as the Intelligence Community Assessment on Russian election interference. The ICA’s core finding — that Russian military intelligence and the SVR had conducted an influence operation against American democracy — corroborated the analytical framework I had laid out.

I want to be precise about what that means, because precision matters here more than it usually does.

The ICA confirmed the legitimate analytical conclusion: Russia had run an operation. The tradecraft was real. The targeting of American institutions was real. The use of human networks alongside technical intrusion was real. And after these attacks, Donald Trump was going to be president. On those questions, twenty years of professional analytical methodology, applied to publicly available information, produced conclusions that the American intelligence community subsequently confirmed. That is what rigorous analysis is supposed to do.

But the ICA did not stop at those legitimate conclusions.

With a heavy political hand from CIA Director John Brennan, the assessment also exaggerated the specific nature of Donald Trump’s relationship with Russia — and it did so based in significant part on the fraudulent work of Christopher Steele, a former British intelligence officer whose dossier has since been thoroughly discredited. Steele’s sourcing was fabricated or unreliable—from at least one agent who, like Steele himself, was on Russian payroll. Steele’s supposed conclusions were not supported by the evidence, because there was none—not from any credible source. And yet that material was incorporated into an official Intelligence Community product, contaminating what should have been a clean analytical finding with politically motivated fiction. Worse, the agency that forced its conclusion, the CIA, specializes in human source validation and had no excuse as to why a disreputable, obvious fraud from a foreign spy was included.

This is not a partisan observation. It is an analytical one, especially given my own thirty-year history of human intelligence collection and analysis. The ICA got the macro question right — Russia ran an operation — and it got specific micro questions wrong, because it was fed bad intelligence by people with interests in particular conclusions.

The consequences of that contamination are still unfolding. As of this writing, a federal grand jury is examining the origins of the ICA, and reporting indicates that John Brennan, who served as Director of the CIA during the period in question, has been among those in the grand jury’s focus. Brennan’s attorneys have indicated in writing that their client is a target of the investigation, meaning that he has been or will be indicted for felonies related to this matter. The legal proceedings will determine what accountability looks like. The analytical record, however, is already clear.

The distinction that matters

I have been called a conspiracy theorist for years — by commentators, by partisans on both sides, and occasionally by people who were themselves later indicted. It is worth explaining precisely why that label never applied.

The conspiracy theorist conflates the operation with the dossier. They treat “Russia ran an operation against America” and “the Steele dossier was accurate” as the same claim, so that discrediting the dossier discredits the entire analytical framework. That conflation served specific political interests and was entirely deliberate.

My analytical framework never depended on the Steele dossier—even though I was briefed on the Dossier’s existence and its conclusions during the summer of 2016 by my colleagues in the Intelligence Community. My own assessment was built from open-source intelligence, pattern analysis of Russian intelligence service tradecraft, and two decades of professional methodology. The dossier’s collapse never touched it. The ICA’s contamination does not touch it. The legitimate core of the ICA’s findings — which I had already documented publicly before the ICA was published — stands independently of the fraudulent material that was layered on top of it.

Separating the signal from the noise is the job of a real intelligence analyst. It has always been the job.

The part I couldn’t tell you about

While I was publishing analysis publicly, I was also doing something else.

Following the December 2016 thread, on dates I cannot reveal, I began working covertly as a Confidential Informant for FBI Counterintelligence. My public profile — as an analyst who had correctly identified the Russian operation and was continuing to map its domestic networks — made me (potentially) operationally useful to the people tasked with dismantling those networks. I reported what I learned. I did this for years.

I could not tell you this while it was happening.

In 2023, I disclosed my role publicly on this Substack. That disclosure is part of the public record. The documentation supporting it — including the congressional testimony of FBI Counterintelligence Special Agent Johnathan Buma, who served as a handler to both myself and other sources — is available in the Substack archive and linked throughout these pages.

The counterintelligence work I participated in was aimed at the same networks I had publicly identified in December 2016. The public analysis and the covert work were not separate efforts. They were the same analytical problem, running on parallel tracks.

The adversary’s response

On May 21, 2022, the Russian Federation formally sanctioned me by name — barring me from entry into Russia and placing me on a list of individuals deemed threats to Russian state interests. I was in good company. The list included the President of the United States, Joe Biden, and a dozen intelligence agency directors. I was one of fewer than twenty civilians whose public profiles do not show the extent of their intelligence work.

I note this not as a point of pride but as a point of analytical record. Governments do not formally sanction private citizens for being wrong. They sanction them for being effective. The Russian Federation’s decision to place my name on an official state document confirmed, in the clearest possible terms, that the work — both public and covert — had registered at the highest levels of the adversary’s attention.

The record, as I said, is the record.

What the full record shows

Taken together, the record from December 2016 through the present demonstrates several things that are directly relevant to the analysis published on this Substack and across my video channels.

First, the macro analytical call — Russian intelligence services running assets and operations against American institutions — was correct, was documented publicly before official confirmation, and has been further substantiated by years of federal investigations and prosecutions. The best is yet to come on that front.

Second, the ICA that corroborated the core finding was itself partially compromised by fraudulent sourcing. The analytical framework I developed was not dependent on that fraudulent sourcing and does not fall with it. The two must be distinguished, and I distinguish them clearly.

Third, the domestic infrastructure that Russian and other foreign intelligence services exploited — the organized crime networks, the corrupted municipal governments, the compromised judicial systems — is the subject of ongoing federal investigation and prosecution. It is also the primary subject of this Substack. Those are not coincidentally related facts.

Fourth, the people who called this work conspiracy theory, who worked to suppress it, and who protected the networks it was mapping are now in significant legal jeopardy. The record of who said what, and when, is intact.

Why this matters for everything published here

When I analyze organized crime infrastructure in the American Midwest, I am not a journalist who stumbled onto an interesting story. I am an intelligence professional who worked that problem covertly for the U.S. Government and to protect my private clients from harm.

When I describe the playbook by which foreign intelligence services exploit ungoverned institutional spaces in American cities, I helped document that playbook for federal investigators.

When I separate legitimate analytical conclusions from politically contaminated intelligence products, I am applying the same methodology that correctly identified the Russian operation in December 2016 — before the ICA, before the Special Counsel, before the indictments.

The analysis on this Substack and at @gametheorytoday on TikTok operates from that foundation. I report what the evidence indicates. I do not soften conclusions for audience comfort. I distinguish what the evidence supports from what has been fabricated or exaggerated. And I have a documented record of doing so accurately, under conditions where accuracy was neither easy nor consequence-free.

The record is the record.

If you are new here — start with the archive. The thread from December 2016 runs directly through everything published on these pages. The methodology has been consistent. The conclusions have held where they were legitimate, and I have identified where official conclusions overreached.

The work continues.

Post-Script

I no longer live in St. Louis. After years of threats to my personal safety — a predictable occupational hazard when you spend a decade mapping the organized crime and intelligence networks that run a city — I have relocated to rural Vermont, where I grew up and where I am, for the record, doing quite well. The work travels with me. The archive is here. The analysis continues.

First published on Game Theory Today (Substack), March 28, 2026.