FBI Arrests CIA Contractor Accused of Leaking Top Secret Reports to Substack Writer

The FBI arrested Ian A. Brinksman, a 42-year-old government contractor who held a Top Secret clearance, on Friday, October 23, 2026, and the Justice Department charged him with unlawfully transmitting national defense information. Prosecutors allege he pulled five highly classified intelligence reports he had no work reason to read and passed their contents to a romantic partner who ran a Substack newsletter.

CIA Director John Ratcliffe said the arrest followed a referral from the agency, and that the contractor "provided services to CIA." The case lands in a year when the Justice Department has openly prioritised leak prosecutions, and it puts a new spotlight on independent newsletters that publish national security reporting.

The charge carries a maximum of 10 years in prison. No one else has been charged, and Brinksman is presumed innocent unless proven guilty.

Key facts at a glance

• Who: Ian A. Brinksman, 42, of Washington, D.C., a systems integration developer for a CIA contractor, with Top Secret/SCI access.
• Charge: Unlawful transmission of national defense information under 18 U.S.C. § 793(d), filed by criminal complaint in the Eastern District of Virginia (Case No. 1:26-mj-423).
• The allegation: He accessed five Top Secret reports outside the scope of his job between March and October 2026, and matching material appeared in five Substack articles.
• The evidence cited: Database access logs, badge-swipe records, emails and more than 800 calls or attempted calls between him and the newsletter writer in 2026.
• The writer: The affidavit calls her "Individual 1." Reuters identified the quoted fundraising post as one written by journalist Aída Chávez on her Capital & Empire newsletter. She has not been charged.

How the case came together

According to the Justice Department announcement, Brinksman began working for a U.S. government agency based in the Eastern District of Virginia in 2020. In 2022 he moved to "Company 1," a contractor to the same agency, as a developer for systems integration.

The sworn FBI affidavit says he first accessed a specific repository of classified intelligence, referred to as "the Classified Database," on August 11, 2022. A footnote adds that his normal duties included transferring data between classified and unclassified systems.

The affidavit describes Individual 1 as the publisher of an independent Substack covering "Congress, War, and political economy." It quotes a September 2026 fundraising post in which she wrote that she had "published reporting based on classified [relevant U.S. government agency] assessments." It also cites a public social media comment: "I also accept leaks."

Reuters, via The Straits Times, reported that the same wording appears in a September 28 post on Capital & Empire by Aída Chávez, who previously worked for The Nation. In the original, the agency named is the CIA. Chávez did not immediately respond to Reuters' request for comment, and the Justice Department did not name her.

The pattern prosecutors describe

The core of the government's case is timing. FBI Special Agent John W. Althen lays out five episodes in which, he says, a phone call with Individual 1 was followed by Brinksman opening a classified report, then more calls, then a Substack article with similar content.

Source: FBI affidavit, U.S. v. Brinksman. All times Eastern Daylight Time.

For each of the five articles, the affidavit says an Original Classification Authority, the official empowered to decide what is classified, confirmed it contained classified information reflecting the matching report. In the first case, that material was classified up to the Top Secret level.

Several further details are meant to close the gap between access and disclosure:

• Phones stay outside. Staff at his workplace cannot carry personal phones, and the agent writes that the short breaks between report access and re-entry gave Brinksman time to reach his car and call Individual 1.
• A narrow pool of readers. Agency records show he was one of no more than six people who opened the Substack page from the facility between March 1 and October 5, 2026, and the only one who viewed all five articles and also accessed all five reports.
• A notebook. On October 10, investigators reviewed a notebook left on his desk and found the corners of several pages torn out.
• None of it was his job. The agency told the FBI that none of the five reports was within the scope of his work.

What he knew about the rules

The affidavit stresses that Brinksman had been warned repeatedly. On December 18, 2025, he signed a non-disclosure agreement granting him access to Sensitive Compartmented Information, or SCI, a category of classified material tied to intelligence sources and methods. That agreement warned that unauthorized disclosure could violate Sections 793, 794, 798 and 952 of federal law.

He also completed training on classification and on system administrator security in March and September 2026, the same year the alleged leaks took place.

The complaint quotes a November 20, 2025 email from his personal Gmail account to a friend. In it he wrote that "the lady I've been seeing is a journalist and recently went independent," adding that he had been helping her "get that off the ground" and that her venture "focuses on foreign policy."

Investigators also describe a shared Google Document on March 13, 2026, titled after a specific country, in which Brinksman suggested an edit that Individual 1 marked "Resolved." An article on that country appeared publicly later that day. The affidavit is careful here, stating that the government has not identified classified information in that particular article.

Officials did not hold back in their statements. Assistant Attorney General for National Security John A. Eisenberg said Brinksman "reached far outside his own duties to obtain some of our Nation's most closely held secrets and handed them to a romantic partner he knew intended to publish them," calling it "a betrayal of his oath." FBI Director Kash Patel called protecting secrets "a top counterintelligence priority."

The other side of the argument

A federal public defender representing Brinksman declined to comment to Reuters, so his side of the story is not yet public.

It is worth being clear about what the affidavit does and does not show. It is a probable cause document, written to justify an arrest, and the Justice Department itself notes that "charges in a complaint are merely allegations." The episodes it describes rest on timing and access records, such as calls, badge swipes and database logs, rather than a recovered copy of a report or a message containing classified text.

Press freedom advocates have long questioned how the government frames leak cases. The Freedom of the Press Foundation says journalists "routinely rely on leaked information to inform the public" and argues that the U.S. "routinely claims, without proof, that the leak damages national security." The group has not, in the sources reviewed, commented on this specific case.

The policy backdrop matters too. In April 2025, Attorney General Pam Bondi rescinded former Attorney General Merrick Garland's limits on subpoenaing reporters in leak investigations, and a revised rule published on May 2, 2025 says the old constraints had "unduly hindered" efforts to subpoena journalists who coordinate with federal employees. That rule still requires enhanced approvals, but it gives prosecutors more room to seek records from members of the news media.

What it means for you

For most readers in the U.S., UK, Canada and Australia, the direct impact is limited, but the case matters to two groups in particular.

Cleared workers and contractors. The affidavit shows how much is logged inside secure facilities: every report opened, every badge swipe, even which outside websites are viewed from agency networks. Anyone holding a clearance should assume that access outside their assigned work is visible and reviewable.

Independent journalists and newsletter writers. Publishing classified material is not what Brinksman is charged with, and Individual 1 has not been charged. Still, the affidavit quotes her public posts and fundraising copy at length. Writers who solicit leaks publicly should expect those statements to surface in court filings.

What happens next

The complaint was sworn by telephone before U.S. Magistrate Judge William E. Fitzpatrick in Alexandria, Virginia. Under the Speedy Trial Act, an indictment or information must generally be filed within 30 days of arrest, which points to a grand jury decision by late November 2026 unless the deadline is extended or waived.

The case is being prosecuted by trial attorneys from the National Security Division's Counterintelligence and Export Control Section, with the U.S. Attorney's Office for the Eastern District of Virginia. The FBI Chicago Field Office is leading the investigation, assisted by the Washington Field Office.

Open questions include whether Brinksman will be detained before trial and whether prosecutors will seek records or testimony from the newsletter writer. Reuters also reported that the State Department and Deloitte, which appears on a LinkedIn profile bearing his name, had not yet commented.

The bottom line

The government says a cleared contractor read five Top Secret reports he had no reason to open and that each one surfaced, in substance, in a Substack article within days. The defence has not spoken yet, and the evidence so far is a timeline of logs and calls.

Three practical takeaways:

1. If you hold a clearance, stay inside your need to know. Access logs, badge records and network browsing are all reviewable, and this affidavit shows investigators matching them minute by minute.
2. If you publish national security reporting, keep your public statements measured. Fundraising posts and comments such as "I also accept leaks" can be quoted in charging documents.
3. If you are following the case, watch for the indictment. A grand jury filing within about 30 days would show whether prosecutors add charges or rely on the single § 793(d) count.

FAQ

Is the journalist charged? No. The complaint charges only Brinksman, and the Justice Department did not name the writer.

What is the maximum sentence? Under 18 U.S.C. § 793, a conviction can bring a fine, up to 10 years in prison, or both.