On October 23, 2026, the Justice Department announced that the FBI had arrested Ian A. Brinksman, 42, of the District of Columbia, on a criminal complaint charging him with unlawfully transmitting national defense information. According to the government, Brinksman, a contractor holding a Top Secret clearance with Sensitive Compartmented Information (SCI) access, passed classified information to a romantic partner who publishes on Substack.
The charges are allegations, and Brinksman is presumed innocent unless and until proven guilty. But the pattern alleged here is one every insider threat program should plan for: a cleared, technical insider reaching beyond his own duties, and a personal relationship serving as the path out of the building.
What happened
- Beginning in 2020, Brinksman worked as an employee of a U.S. government agency based in the Eastern District of Virginia.
- In 2022, he became a systems integration developer for “Company 1,” a contractor to that agency.
- He held a Top Secret security clearance with SCI access.
- The government alleges he passed classified national defense information to a romantic partner, identified as Individual 1, who publishes on Substack.
- According to the release, a September 2026 fundraising article by Individual 1 claimed she had published reporting based on classified assessments, and she posted that she accepts leaks.
- CIA Director John Ratcliffe said the arrest followed a referral from the agency.
- The FBI arrested Brinksman on October 23 after searching his residence. The FBI Chicago Field Office is investigating, with substantial assistance from the Washington Field Office. The National Security Division and the U.S. Attorney’s Offices for the Eastern District of Virginia and the District of Columbia are prosecuting.
Assistant Attorney General for National Security John A. Eisenberg said, “As alleged, Brinksman reached far outside his own duties to obtain some of our Nation’s most closely held secrets and handed them to a romantic partner he knew intended to publish them.” (Justice Department)
Lessons for every insider threat program
- Alert on access outside a user’s lane. The government’s central allegation is that the material was “far outside his own duties.” Need-to-know only protects information if someone is watching for violations of it. Baseline what each role normally touches, and have user activity monitoring (UAM) flag searches, queries, and document views that fall outside a user’s assigned programs, especially for developers and integrators whose technical access is broad by design.
- Treat systems developers as privileged users. A systems integration developer often has visibility across many data sources simply to make them work together. That access should come with heightened monitoring, periodic access reviews, and a documented business reason for each repository a developer can reach.
- Give security officers a full picture of risk. Here, the alleged path out of the building was a personal relationship with someone who publicly said she accepts leaks. Make sure your workforce understands its reporting obligations, make reporting easy and non-punitive, and route what is reported to the insider threat hub so analysts can weigh it alongside technical indicators.
- Watch for your information outside the walls. In this case, the recipient publicly claimed to be reporting from classified assessments and said she accepts leaks. Monitoring open sources for your own programs and information, and having a playbook to trace an apparent disclosure back to the people who had access, turns a public leak into an investigative lead.
- Build the referral path before you need it. This arrest followed an agency referral to the FBI. Contractor and government insider threat programs should know exactly who they refer to, what evidence they need to preserve, and how to hand it off quickly and lawfully when an indicator becomes a case.
How TMPC helps
Unauthorized disclosure cases like this one are exactly what user activity monitoring and a well-run insider threat hub are built to detect early. Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
- User activity monitoring (UAM) and insider threat analysis, including need-to-know and out-of-role access detection
- Insider threat program development, policy, reporting procedures, and training for cleared workforces
- Privileged user access reviews and referral playbooks that move indicators to action
To talk with our team, contact info@tmpcinc.com or 813.524.6935.