U.S. Intelligence Begins To Rethink Its Analysts' Emirati Career Path

Edited by Sam Thielman

RARELY DO YOU SEE the U.S. intelligence agencies get in the way of lucrative post-retirement contracting jobs. But a new intelligence report calls one of the most successful recent career paths for CIA and NSA alumni a national-security threat.

On Sunday, John Hudson of the Washington Post reported that the National Intelligence Council (NIC)—the senior-most assemblage of analysts from across the 18 U.S. intelligence agencies—assesses that the United Arab Emirates has launched "extensive efforts to manipulate the American political system." Hudson correctly points out that such a report is highly unusual, considering the country in question is a major U.S. weapons purchaser (more on that in a moment). Don't expect a cold war against Abu Dhabi.

If the NIC's warning is as dire as John reports, then U.S. intelligence considers UAE political-financial influence in this country to be an espionage problem. But if so, the people who created that espionage problem are, in substantial part, retired CIA, NSA and military officials with deep experience in the War on Terror.

For over a decade, the unfathomably wealthy UAE has overhauled its security capabilities and established itself as a regional powerhouse with an aggressive foreign policy. As a U.S. ally in the War on Terror, Abu Dhabi did so by relying on the expertise of American counterterrorists, sometimes to the point of cutting out the middleman.

Blackwater's Erik Prince was disgraced after the Nisour Square massacre in 2007 and lost a lot (but hardly all) of his American business. Around the time of the Arab Spring, the UAE, seeing an opportunity, hired Prince to build it a new mercenary army in the former Navy SEAL’s own image. While a tremendous amount of UAE public diplomacy portrays Abu Dhabi as focused on threats from Iran and Sunni jihadis, Prince's efforts, the New York Times reported, "could be deployed if the Emirates faced unrest in their crowded labor camps or were challenged by pro-democracy protests."

Given the alibi of counterterrorism for its domestic repression, it was only a matter of time before the UAE, with the aid of American counterterrorism practitioners, built itself a sophisticated surveillance apparatus. Its efforts proceeded in phases. First it contracted with U.S. security companies, which are typically run and staffed by retired American military and intelligence officials, and hired hackers from around the world. One significant U.S. contractor was the Maryland-based CyberPoint, which held a contract with the Emirati interior ministry.

Lori Stroud, a retired NSA-slash-BoozAllen analyst and a rare person to come forward about purpose-built UAE surveillance, went to work for CyberPoint in the Emirates because it seemed in her wheelhouse. Her recruiter for CyberPoint, Marc Baier, used to be a colleague at NSA's Hawaii outpost. She understood her job to be functionally similar to what she did for NSA: counterterrorism. Only now she got to win. “It was incredible because there weren’t these limitations like there was at the NSA," Stroud told Reuters in 2019. There wasn’t that bullshit red tape… I feel like we did a lot of good work on counterterrorism.” It helped that in the Emirates she could make upwards of $200,000 a year.

In practice, that lack of that "red tape" meant spying on dissidents, journalists and their contacts, including Americans. One early target was the activist Ahmed Mansoor, a frequent government critic. According to an excellent 2016 piece Jenna McLaughlin did for The Intercept:

CyberPoint was essentially capable of penetrating millions of devices regardless of brand, given its awareness of vulnerabilities—undiscovered or unpatched—in software around the world, one source explained. Those included vulnerabilities in Tor Browser, Firefox, Internet Explorer, and Microsoft Office.

All that access enabled Stroud's colleagues to break into Mansoor's computer and find evidence of communications with relatives of imprisoned dissidents—evidence that would contribute to Mansoor’s 10-year prison sentence.

Their work was known as Project Raven or Project DREAD, for "Development Research Exploitation Analysis Department." By the time Stroud signed on, American intelligence veterans within Raven/DREAD comprised between 12 and 20 personnel, "the majority of the staff," according to Reuters. As their surveillance enterprise expanded, Reuters reported, Stroud "noticed American data flagged for removal show up again and again in Raven’s [Emirati]-controlled data stores."

A 2014 agreement between CyberPoint and the State Department—which, intriguingly, required the NSA to sign off on briefings the contractor gave about computer-network exploitation or analysis—became a way to wave away American analysts' concerns about what Raven/DREAD was building. Although, c'mon—when you're working for something called Project DREAD, you really don't have any excuse.

By 2015, the UAE's version of NSA/Cyber Command, the National Electronic Security Authority (NESA), turned the ratchet. It muscled CyberPoint out in favor of a UAE cybersurveillance firm called DarkMatter. Wary of losing their American intelligence experts, NESA offered CyberPoint's Raven/DREAD contractors the opportunity to stay on the project as DarkMatter contractors. The result was to continue the project under greater Emirati control.

Around the time DarkMatter took over, Raven/DREAD moved into phone exploitation. Using a tool called Karma, Raven/DREAD exploited security vulnerabilities in Apple's iMessage to access data on someone's iPhone or iPad without requiring a user to click on a malware link, and its technicians raced to stay ahead of Apple's software patches. As you'll read next year in a powerful book by the journalists Laurent Richard and Sandrine Rigaud, this is awfully similar to how the NSO Group's infamous Pegasus spyware works, down to the iMessage targeting. (I was asked to blurb the book, so I read it early.) In addition to Karma, DarkMatter, through cutouts, developed an app, ToTok—pause a moment to observe spyware branding in the wild—that permitted Emirati users to make video calls that the UAE bans. A 2019 New York Times exposé said ToTok had "surged to become one of the most downloaded social apps in the United States last week."

Stroud rationalized a lot of the surveillance in the classic way that security contractors do: they were serving the customer's needs. In this case, the customer was the security apparatus of a U.S. ally in the War on Terror. “Some days it was hard to swallow, like [when you target] a 16-year-old kid on Twitter,” Stroud told Reuters' Christopher Bing and Joel Schectman. “But it’s an intelligence mission, you are an intelligence operative. I never made it personal.” If you're my age, this is when you start humming "Karma Police."

CONSPICUOUSLY AFTER DARKMATTER REPLACED CYBERPOINT, per Reuters, the FBI took an interest in the retired intelligence and military officials who took up work for Emirati security agencies. Their concern was that the retirees applied tradecraft they could have only gotten through their NSA/CIA/etc. employment on behalf of a foreign government. Notice that when Keith Alexander does the exact same thing with Amazon, it makes him a shrewd businessman on the cutting edge of an important emerging service, rather than an espionage risk, and since Amazon is an American corporation, it's cool.

Alarm seems to have grown within the U.S. Security State last year. In January 2021, the CIA's chief of counterintelligence warned agency retirees against working, "directly or indirectly," for foreign governments: "[F]ormer C.I.A. officers who pursue this type of employment are engaging in activity that may undermine the agency’s mission to the benefit of U.S. competitors and foreign adversaries." Then, last fall, the Justice Department brought charges against three U.S. intelligence and military veterans working for the UAE on Raven/DREAD. One of them was Marc Baier, the former NSA Tailored Access Operations official who recruited Lori Stroud for CyberPoint.

Baier and the others entered into a deferred-prosecution agreement and agreed to pay a large fine. A statement of facts the defendants had to accept as a condition of their agreement validated much of the earlier Reuters and Intercept reporting: "Defendants used illicit, fraudulent, and criminal means, including the use of advanced covert hacking systems that utilized computer exploits obtained from the United States and elsewhere, to gain unauthorized access to protected computers in the United States and elsewhere and to illicitly obtain information, material, documents, records, data and personal identifying information, including passwords, access devices, login credentials and authentication tokens, from victims from around the world."

The deferred prosecution clearly allowed the FBI to gather information on the privatized UAE surveillance build-up and its dependence on U.S. intelligence vets. I suspect that's key to the NIC document Hudson reported on. As the document apparently notes, the structure of permissible U.S. campaign donations means that many UAE influence operations in U.S. politics don't have to take the form of espionage. The whole point of American politics as currently configured is the hegemony of the capitalist order. Capital doesn't have nationalities, only places to park. In such an environment, one person's corruption is another's diplomacy. That's why the UAE is among the top foreign donors to American think tanks (alongside the UK and sleeper candidate Norway), according to a 2020 report from the Center for International Policy, and also why Emirati royals booked suites at the Trump International.

It's also why people like Jim Mattis—and literally hundreds of U.S. military and intelligence veterans like him—aren't considered agents of a foreign power despite pressing legislators to support the UAE, which Mattis calls "Little Sparta." Personally, my read of Thucydides is that a Little Sparta isn't, like, good, but what do I know. The point of the nickname is to shore up support for hostility to Iran, even though the metaphor ultimately turns against the UAE whether the context is either the Peloponnesian War or Thermopylae.

Another factor may have influenced the timing of the NIC report, although this is pure speculation and should be treated as such. You may remember that during the Trump administration, Jared Kushner put together an arms sale in the guise of Mideast diplomacy, the Abraham Accords, which united a previously-unofficial anti-Iran coalition of the U.S., Israel, Saudi Arabia and the UAE (while also signaling that the Palestinians are, as always, on their own). The centerpiece of the accords was a massive sale of American drones, F-35 fighter jets and related weaponry. The Biden administration put the sale on hold in part because of concerns about the UAE's ties to new-cold-war rival China. You'll remember that last year, the U.S. pressed the UAE to pause construction on a port the UAE was going to open to the Chinese military. The administration decided to let the UAE arms sale proceed, but Abu Dhabi, bristling at what it considered U.S. intrusion upon its sovereign national-security decision-making, this spring bought $19 billion worth of French fighter jets, which come with no such stipulations designed to restrict the China-UAE relationship.

Such Neo-Cold War prerogatives—along with the UAE financing the Russian mercenaries known as the Wagner Group—may have had the effect of getting U.S. intelligence to consider the espionage implications of a career path that has previously followed the security and economic logic of the War on Terror.

WALLER VS. WILDSTORM IS UNFORTUNATELY DELAYED. I really wish I could have followed up the UAE post with an announcement saying you should go to your local comic store this week if you'd like to see how I fictionalize many of the structural dynamics outlined above and put them into a superhero universe. This edition especially, considering we're talking about characters called stuff like DarkMatter and CyberPoint.

But this book is not canceled, and I am very, very grateful to Chris Conroy, Marquis Draper, Marie Javins and Jim Lee. New friends of mine in the comics business tell me that this happens pretty frequently. The miniseries would very likely have fallen off its schedule, so it makes sense to push the book back so it all gets to stores – and, therefore, you – on time. There will be more news on the revised WALLER VS. WILDSTORM schedule in the near future. The delay only means you have more time to pre-order the book at your local comic shop.

While you're there, pick up WAKANDA #2, written by my friends Evan Narcisse, co-writer of WALLER VS. WILDSTORM, and Adam "The Cruelty Is The Point" Serwer. You should also praise them really fulsomely on social media. And for your WildStorm Universe fix, get WILDCATS #1 from Matthew Rosenberg and Stephen Segovia, which I really enjoyed, not least of which for the Clark's Bar reference.  

And now a note on the midterm elections, from FOREVER WARS editor Sam Thielman.

DESPITE THE ENTIRE NATIONAL MEDIA forecasting an across-the-board drubbing for the Democrats, voters inexplicably rejected Republican messaging, which tended to emphasize the perfidy of kindergarten teachers and the uselessness of voting. Jared Holt has some good thoughts on that here but I want to call attention to a particular strain of the culture war virus because it is so obviously and extremely harmful to vulnerable people, and that is the right-wing assault on gender-affirming healthcare for children.

The topic has obsessed a surprisingly large percentage of the commentariat despite not resonating at all with the general population. In fact the most receptive audience for this sort of bile has turned out to be editors at several respectable publications. The current line of attack is something like this: The medical community is beset by controversy about the use of top surgery or puberty blockers, and some reasonable people believe that minors ought to be kept away from such extreme treatments for their own good. This efficiently recasts individual medical decisions as the worthy subject of high-minded debate between two groups of well-meaning people, and of course journalists are at their leisure to artfully assign sincerity, disingenousness, or fanaticism to the various players.

There are two problems with this frame, which amounts to a public litigation of acceptable expressions of trans identity. The first is the reflexive paternalism of this position, which dovetails nicely with the reflexive paternalism of an influential faction at the New York Times, a repeat offender here (and, not coincidentally, the agenda-setter for many other news organizations).

People ought to be able to make terribly private medical decisions like these for themselves and their families. The only role the state should play in those decisions is, to my mind, licensing doctors, accrediting medical schools, and probably picking up more of the tab. Lauren Theisen observes over at Defector that the risks of medical transition don’t even begin to outweigh the rewards for most patients, and as someone who has actually experienced medical transition—unlike anyone interviewed in the Times’s latest broadside—she should know. Theisen puts it better than I can:

Every single medical choice we make for ourselves or for our children can be framed by its dangers instead of its benefits. Even though it’s important to have a complete picture of what a drug or treatment can do before taking it, widespread fear-mongering over rare and manageable adverse reactions is proving to be more and more of a threat to public health, undermining trust in the safest options we have because some folks have a bad feeling about it. Combining the fragile, still-burgeoning field of adolescent trans medicine with the ugliness people display when their children and the world around them don’t line up with how they want them to be creates a potentially awful, deeply frustrating situation for the actual kids who need this care, and might die without it.

Edge cases in which people are harmed by elective medical interventions will always exist. But so far as I can tell, there are remarkably few of these among transgender children. That's in part because many of the doctors in this field seem to be genuinely selfless, cautious, intelligent people, and in part because parents who are willing to pursue such a regimen of expensive and exotic treatments for their children obviously care deeply about them. Children get rhinoplasties and breast augmentation/reduction without any national hand-wringing over whether or not they ought to be forbidden from doing so by statute. Nobody writes insinuating magazine-length features about them or assigns a beat reporter to question the utility of those surgeries. Perhaps the idea of a vulnerable seventh-grade girl getting parental permission for breast implants stands your hair on end; I don’t blame you if it does. I don’t think the procedure should be forbidden on general principle, though, and perhaps you don’t, either—what about those rare cases where young children get breast cancer? What about people who’ve been in horrible accidents and need reconstructive surgery? What about people with genetic differences that affect the way their body matures? All of these cases overwhelmingly argue against some sort of policy intervention that would punish anyone seeking a particular kind of treatment from a knowledgeable doctor.

The second problem with this line of argument is that supposed concern for the welfare of trans children makes no sense unless there is some danger to the welfare of trans children beyond the simple availability of esoteric treatments. Trans children do not suffer from an excess of medical care. Few in this country do. The constant drumbeat of conservatives and their allies preoccupied with the genital configurations of small children goes like this: “Oh, so we can’t even ask questions! Why won’t you even debate about this?” Well, why should I? I don’t want to talk about toenail fungus treatments even though I’m delighted for people to have access to them. I won’t debate the anti-circumcision activists who hang around outside the Union Square Barnes & Noble.

Unlike athlete’s foot and circumcision, anti-trans panic has been elevated to a matter of national policymaking, and Republican presidential hopeful Ron DeSantis has actually made it illegal for trans children to receive medical interventions that will prevent them from going through puberty as the wrong gender. Why is this absurd hysteria coming from the same conservatives who constantly avow that they’re merely asking questions in the service of dispassionate debate? Because conservatives believe that whole classes of people—gay, lesbian, trans, bisexual—only exist, or only exist in such large numbers (never mind how small), when children are encouraged to join those classes as part of a “social contagion,” which perhaps contextualizes the accusation trans kids are only accorded healthcare and basic dignity by depraved adult “groomers.” (This ought to sound very familiar to anyone who lived through the post-Stonewall gay rights movement.) Conservatives also seem to think that the way to keep people from belonging to a sexual minority is to deny them the basic right to self-identify, and the easiest population from whom to withhold fundamental rights is small children. If you lop off the part of the argument that posits a perverted cabal dedicated to recruiting children, the “why can’t we all get together and talk about strangers’ private medical decisions” part of the argument shrivels up and dies.

Of course, if you’re brave enough to admit that you think adults do recruit children into their affinity groups for purposes of exploiting them sexually, you might have to field a few questions about where that idea comes from. And honestly answering that question will lead you right into the deepest fever swamps of the evangelical right wing, hanging out with Terry Schilling and his American Principles Project, or the Federalist Society’s favorite anti-LGBT hate group, the Alliance Defending Freedom, currently run by Michael Farris, who founded hard-right Christian college Patrick Henry.

And if you’re not brave enough to admit that you believe in a secret society of adult deviants who nefariously plot to make children trans, then the argument against allowing those children and their parents to make their own profoundly intimate medical decisions doesn’t even make sense on its own terms, and you should be quiet.