A contractor who provided services to the CIA and held a Top Secret clearance was arrested on Friday, Oct. 23, and charged with passing classified intelligence to a journalist he was dating, who published it on Substack. Ian A. Brinksman, 42, of Washington, D.C., is charged with one count of unlawfully transmitting national defense information under the Espionage Act, which carries up to 10 years in prison. CIA Director John Ratcliffe said the agency referred the case to the FBI.
The FBI’s 13-page affidavit doesn’t claim agents caught Brinksman handing anything over. It builds the case from records the agency already kept on him: which classified reports he opened and when, when his badge took him in and out of the secure facility, and when his phone rang. Five times this year, the affidavit says, that pattern ended with an article.
March 11, minute by minute
The first sequence starts at 8:41 a.m. on March 11, when the journalist, identified in the filing only as “Individual 1,” called Brinksman’s cell phone. At 9:09 a.m. he opened a report marked Top Secret in a classified database, and he opened it again at 10:01. Badge records show him leaving the building at 11:15 a.m., coming back eight minutes later, and leaving again at 1:02 p.m. That evening she called him for about 14 minutes. The same day, she posted an article that an Original Classification Authority later confirmed contained Top Secret information reflecting the report.
Phones aren’t allowed inside the secure area where he worked. FBI Special Agent John W. Althen wrote that most people there keep their phones in their cars, and that the short trips out of the building “would have provided him sufficient time” to reach a phone, talk to her and return. That is the agent’s inference from the timing. The affidavit does not describe the content of any call.
The other four sequences follow the same shape. In each, the government says the article contained classified information from the report Brinksman had opened, and the agency says none of the five reports had anything to do with his job.
| Report opened | Contact with Individual 1 (per affidavit) | Article posted | Article’s subject (per Ynet) |
|---|---|---|---|
| March 11, 9:09 and 10:01 a.m. (Top Secret) | She called at 8:41 a.m.; a 14-minute call that evening | March 11 | Bahrain bringing in Jordanian forces to put down protests over the Iran war |
| May 12, 11:26 a.m. (Top Secret) | He left the facility at 12:57 p.m. and called her at 1:07, then three more times that afternoon | May 13 | A CIA assessment of splits among Gulf allies over striking Iran |
| May 26, 9:10 a.m. | He left at 3:00 p.m. and called her at 3:13, 3:30 and 6:44 | May 28 | Israel privately pressing the U.S. to kill Iran’s parliament speaker, Mohammad Bagher Ghalibaf |
| July 28, 10:32 a.m. (Top Secret) | He left at 11:32 a.m. and called her at 11:45 for about 18 minutes | July 29 | Israeli efforts to tie itself more tightly to the U.S. military and defense industry |
| Aug. 24, 25 and 26, and Oct. 1 (Top Secret) | On Oct. 1 he left at 12:03 p.m.; she called at 12:11 for 47 minutes, and he called her for 37 minutes that evening | Oct. 5 | A CIA Red Cell paper warning Israel could slide toward severe internal conflict |
All five reports carried TS/SCI banners, according to the filing. The affidavit also counts more than 800 calls or attempted calls between the two so far in 2026.
Six people in the building read her Substack
The detail that does the most to narrow the field comes near the end of the affidavit. Agency records show that between March 1 and Oct. 5, no more than six people at the facility opened the journalist’s Substack page from work. Brinksman was one of them, and none of the others both read all five articles and opened all five reports.
The rest of the filing fills in the relationship. On Nov. 20, 2025, before he opened any of the reports, Brinksman emailed a friend from his Gmail account. “The lady I’ve been seeing is a journalist and recently went independent,” he wrote, adding that he was helping her get the venture off the ground and finding it fulfilling. On March 13, the affidavit says, she shared a Google Doc with him for editing, and within about 12 minutes he had suggested a wording change and she had marked it resolved. The government has not found classified information in that article.
Agents also looked at a notebook left on his desk and found the corners of several pages torn out. The agent wrote that, in his experience, people take notes so they can pass along near-verbatim quotes. The affidavit stops there. It doesn’t say what was on the missing corners.
One more detail cuts the other way. As a clearance holder, Brinksman had to submit anything he published for prepublication review, and the affidavit says he did so for the articles he co-wrote with her.
“I also accept leaks”
The government’s filings never name the journalist. They quote two things she published. A September fundraising article said she had “published reporting based on classified [relevant U.S. government agency] assessments,” in the affidavit’s bracketed version, and a public social media post said, “I also accept leaks.”
Reuters, The Hill and the Israeli news site Ynet have each matched those details to Aída Chávez, a former congressional correspondent for The Intercept and Washington correspondent for The Nation, who launched an independent newsletter called Capital & Empire. Reuters found the fundraising passage in a Sept. 28 post on the newsletter, where her version names the agency as the CIA. Ynet reported that five Capital & Empire articles fall on the affidavit’s dates and matched each one to a subject, the descriptions in the table above. The Oct. 5 article on Israel’s internal stability was published with Drop Site News, according to Ynet. Those matches are the outlets’ work. Prosecutors have not confirmed them.
Chávez has not been charged with any crime. She did not respond to requests for comment from Reuters or The Hill. A federal public defender representing Brinksman declined to comment to Reuters, and a complaint is only an allegation.
Who Brinksman worked for is also partly a matter of reporting. The affidavit says he joined a government agency in Northern Virginia around 2020 and moved to a contractor, “Company 1,” in September 2022, where he worked as a systems integration developer moving data between classified and unclassified systems. Reuters found a LinkedIn profile under his name listing State Department foreign service work and a job at Deloitte. The State Department declined to comment, and Deloitte did not respond.
The DIA analyst who did the same thing in 2018
The case closely resembles one prosecuted in the same federal district six years ago. Henry Kyle Frese, a Defense Intelligence Agency counterterrorism analyst from Alexandria with a TS/SCI clearance, was sentenced to 30 months in prison in June 2020 for leaking classified information to two journalists.
According to the Justice Department, Frese lived with the first journalist for most of 2018, and her outlet published eight articles that spring and summer drawn from five intelligence reports about foreign weapons systems. Those reports were outside the scope of his job. The court record describes a familiar sequence. In spring 2018 he searched a classified system for terms from one of the reports, and within hours he was on the phone with both journalists. ClearanceJobs identified them as Amanda Macias, then of CNBC, and Courtney Kube of NBC.
Frese pleaded guilty, ClearanceJobs reported. Brinksman’s case is at the complaint stage, and we found no record of a detention hearing or indictment as of Oct. 29. The charging documents are on the Justice Department’s site: the Oct. 23 press release and the FBI affidavit. The department’s 2020 release on the Frese sentencing lays out the earlier case.
Sources
- FBI Special Agent John W. Althen, affidavit in support of a criminal complaint, United States v. Brinksman, No. 1:26-mj-423 (E.D. Va., filed Oct. 23, 2026). Used for: the charge, employment history, the five access-and-call sequences, the 800-plus calls, the six-person Substack finding, the notebook, the November 2025 email, the March 13 Google Doc and prepublication review.
- U.S. Department of Justice, “U.S. Government Contractor Arrested for Allegedly Leaking National Defense Information” (Oct. 23, 2026). Used for: the arrest, the search of his home, the fundraising and “I also accept leaks” quotes, and statements by Ratcliffe and the National Security Division.
- Reuters, Daniel Trotta, “US accuses government contractor of leaking classified info to girlfriend’s Substack” (Oct. 23, 2026). Used for: the match to Chávez’s Sept. 28 post, comment requests, the public defender, and the LinkedIn, State Department and Deloitte details.
- Ynet, Daniel Edelson, “CIA contractor accused of leaking US reports on Israel to journalist girlfriend who published them” (Oct. 2026). Used for: the article-by-article subject matches, Chávez’s past employers and the Drop Site News co-publication.
- The Hill, “Government contractor faces charges for allegedly leaking national defense information” (Oct. 2026). Used for: the Capital & Empire match and the comment request.
- JNS, Jessica Russak-Hoffman, “CIA contractor charged with leaking secrets about Israel to journalist girlfriend” (Oct. 26, 2026). Used for: corroboration of the identification and the Oct. 5 article.
- Newsweek, Alex Backus, “Who Is Ian Brinksman? US Contractor Accused of Leaking Defense Info” (Oct. 23, 2026). Used for: corroboration of the affidavit’s account.
- U.S. Department of Justice, “Former DIA Analyst Sentenced for Leaking Classified Information to Journalists” (June 18, 2020), via GlobalSecurity.org. Used for: the Frese case.
- ClearanceJobs, Christopher Burgess, “DIA Analyst Frese Gets 30 months in Federal Prison” (June 18, 2020). Used for: the journalists’ names and the guilty plea.