Menu
Menu
Counterintelligence (CI) is the work of detecting, understanding, and countering the efforts of foreign intelligence entities — and the people acting on their behalf — to collect against, penetrate, deceive, or influence a target. That target has never been limited to classified documents. It includes sensitive but unclassified information, and information that only becomes sensitive when combined with other pieces — the kind of mosaic picture a foreign service can assemble without ever touching a classified system. And it has never been limited to technical collection. Recruiting a human source, cultivating a relationship, running an influence campaign — these are, and have always been, core CI concerns.
That’s because the actual objective of most foreign intelligence activity was never the secret itself. It was the decision the secret, the relationship, or the access could shape. A recruited source doesn’t just hand over documents — they shape what a decision-maker believes, delays, or approves. That’s precisely why foreign intelligence services have spent decades cultivating human sources, witting or unwitting: recruitment is one of the most direct paths to a decision.
A recent open hearing before the House Permanent Select Committee on Intelligence, “States on the Frontlines of Counterintelligence,” put a modern version of that same objective on the record. Witnesses — the president of the National Fusion Center Association, a state fusion center director, and state legislators actively writing counterintelligence law — described adversaries reaching state and local decisions not by recruiting a single official, but by running coordinated narrative campaigns aimed at the entire audience around a decision: a city council, a legislature, a community. Same objective as classic recruitment. Different mechanism. Far larger scale.
That combination — CI’s long-standing focus on decisions and access, now playing out at platform scale — is what Narrative Intelligence is built to address: the ability to detect, assess, and understand the narratives shaping decisions before those decisions become outcomes.
Some of the numbers put on the record are worth sitting with. The FBI was reportedly opening a new China-related counterintelligence case roughly every 12 hours, with more than 5,000 active cases nationwide — about half tied to the Chinese government. That workload flows, in part, through a network of 80 state and regional fusion centers and roughly 3,200 personnel who are supposed to be the connective tissue between local observations and federal intelligence.
The chairman of the committee put the stakes bluntly: “I’m deeply concerned our next 9/11 level event has already been set in motion in the counterintelligence domain.” Whether or not you’d phrase it that starkly, the more interesting claim underneath it is about where the first signs of a threat actually show up. As he put it, “the first indicators will rarely appear in Washington. They may surface in a county zoning office, a university research partnership, a port authority, a sheriff’s investigation of suspicious drone activity, or a fusion center connecting threads no single agency has seen alone.”
Foreign influence operations — covert or deceptive activity conducted by, or coordinated with, a foreign government to shape a target’s decisions or perceptions — sit inside the same CI mission described above. That’s not a new category grafted onto counterintelligence; the FBI has run a foreign influence program for years, and the intelligence community has long tracked foreign disinformation and active-measures campaigns as counterintelligence matters, not communications problems. What the hearing put on the record is how far down that activity now reaches: not just national elections and federal agencies, but city councils, state legislatures, and local infrastructure fights.
Witnesses described organized opposition to new AI data center projects, seeded and amplified across TikTok and Facebook, built around water-usage and grid-strain framing. Separately, they pointed to community organizations in New York described as linked to United Front influence efforts, working to defeat candidates seen as unfriendly to Beijing. And in one of the more striking moments of the hearing, a Florida state representative described how a fabricated social media post — falsely claiming his own counterintelligence legislation would create a “secret police” targeting people by religion and political belief — spread to roughly 9,000 shares and nearly derailed the bill before he could correct the record.
A sample EdgeWatch screenshot shows narrative tracking reliability, factual-accuracy, and incitement scores for the AI-data-center-opposition narrative described above, as it develops over time — the kind of early signal that flags a narrative campaign gaining momentum well before it reaches a decision point.
None of those examples required recruiting a source or breaching a network — but they pursued the same objective classic recruitment does: reaching the people who make a decision, and shaping what they believe before they make it. The difference is mechanism and scale. A cultivated human source reaches one decision-maker. A coordinated narrative, amplified across the right platforms, can reach an entire city council, legislature, or community at once. Whether a given instance of that rises to a coordinated foreign intelligence operation — rather than organic public sentiment — is exactly the assessment problem CI analysts, and the tools built for them, now have to solve. As one member of the committee put it, watching this dynamic play out around local opposition to infrastructure projects: “China is not going to beat us in the modern battlefield with a bullet and a gun. They’re going to beat us with one post at a time.”
It’s tempting to treat a viral rumor or a seeded protest campaign as a communications problem — a bad news cycle to manage. That undersells what’s actually happening. A foreign intelligence service that recruits a source to influence a zoning decision is engaged in classic CI activity, full stop. A foreign-directed campaign that reaches the same zoning board through a coordinated narrative, without ever recruiting anyone, is pursuing the identical objective through a different channel. The tradecraft term for both is social engineering: getting a target to think, decide, or act in a way that serves someone else’s interest, without the target realizing why.
Consider the Florida bill described above: a single fabricated post reached 9,000 shares and nearly cost the sponsor his own counterintelligence legislation. A foreign intelligence service that wanted that bill to fail could have spent months trying to cultivate a source close to the committee. Instead, based on the pattern witnesses described, a comparable result was within reach through one well-placed piece of content. That’s a real legislative outcome, shaped without recruiting anyone — the same prize CI has always protected, arriving through a cheaper, faster channel.
That’s why treating this as a messaging exercise misses the point. The response isn’t a press release — it’s the same kind of analysis CI has always applied to a suspected recruitment: who is behind it, how they gained access, and how coordinated the effort actually is.
Source classification from a sample EdgeTheory EdgeWatch on the same narrative show roughly a third of amplifying accounts are classified as Chinese-aligned media, and roughly a third as Russian-aligned — the “who’s behind it” answer, grounded in the network structure itself rather than a guess.
It would be comforting to believe the answer is simply monitoring social media more closely. It isn’t, for two reasons the hearing surfaced clearly.
First, the infrastructure to spot this in real time is fragmented. Fusion center analysts described juggling seven or more disconnected federal information systems during a single major event, re-entering the same data into each one because the systems don’t talk to each other. There’s no unclassified, fast-moving channel built for exactly this kind of signal — the kind that doesn’t require a security clearance to act on, because it’s already public.
Second, and more importantly, the answer can’t be indiscriminate surveillance. Witnesses were unusually direct about this. As one Florida legislator put it, describing the guardrails his own bill needed: “state-level counterintelligence cannot become a license to monitor [people] for who they are, where they come from, who they love, what they believe, or what they lawfully say.” A member of Congress raised the same tension from a different angle, describing his own uncertainty when a wave of local opposition to a data center project appeared online: “I don’t know what to believe anymore because I don’t know if the data you’re giving me is a Chinese operation to work against me or not. That is the real problem here.”
That’s the actual challenge: telling the difference between a coordinated, foreign-directed narrative and a community that genuinely has concerns — without treating every skeptical citizen as a suspect.
None of this is a new CI mission grafted onto an old one. Foreign influence, deception, and disinformation have been recognized counterintelligence concerns for as long as the discipline has existed — the FBI’s own foreign influence program and the intelligence community’s work on active measures predate this hearing by decades. What’s changed is scale and visibility: a foreign service no longer needs to cultivate a single source to reach a decision-maker. It can run the same play against an entire city council, legislature, or community, in public, using commercial platforms — and much of the infrastructure built to catch this was sized for the recruit-a-source version of the problem, not the reach-a-community version.
Open-source information — the raw material of open-source intelligence, the kind anyone can see, on any platform, in real time — is becoming as operationally significant as classified reporting once was, because it’s often where this scaled version of an old technique first shows up. What makes this shift significant is that many of the earliest indicators are publicly visible: local news, public meetings, social platforms, advocacy campaigns, procurement discussions, community conversations. The challenge is no longer access to information; it’s recognizing which signals represent coordinated foreign-directed activity and which reflect legitimate public discourse — the same recruitment-detection question CI has always asked, applied to narrative instead of a single human source.
This is precisely the type of information environment Narrative Intelligence is built to work in — one where the challenge isn’t simply collecting more information, but identifying the narratives, actors, and influence patterns that shape decisions before those decisions become outcomes.
A sample Edgewatch consolidates recent and publicly announced upcoming mobilization activity — including a coordinated day of action spanning 120+ protests across 37 states — into one view, instead of an analyst piecing it together source by source.
Narrative Intelligence gives decision-makers a way to see that shift before it costs them a vote, a permit, or a project — by identifying who’s actually driving a narrative, how it’s spreading, and whether it warrants a response.
If a narrative could already be shaping a decision inside your organization, now is the time to find out.
Sign Up for a Personalized Live Demo
Every critical decision is influenced by information. The question is whether you can see the narratives shaping those decisions before they become outcomes. Experience Narrative Intelligence in action and discover how EdgeWatch identifies emerging influence campaigns, maps narrative networks, and surfaces early warning indicators that traditional monitoring tools miss.
