150 sourced events from 1924 to 2026. The year shown is the year of the event itself; for document releases it is the year of release. This is a selection of what we have sourced, not a complete history.
Four days before the 1924 general election the Daily Mail splashed a letter attributed to Grigory Zinoviev of the Comintern, urging British communists to mobilise “sympathetic forces” in the Labour Party. Labour lost the election. A 1999 Foreign Office study by chief historian Gill Bennett concluded that the letter was almost certainly a forgery.
In early March 1940 NKVD chief Lavrentiy Beria submitted a proposal to Stalin concerning Polish prisoners held in camps at Kozelsk, Ostashkov and Starobelsk. The killings followed in spring 1940, and Soviet propaganda later blamed Nazi Germany. On 26 November 2010 the Russian State Duma adopted a statement saying the crime was carried out on the direct orders of Stalin and other Soviet leaders.
CIA documents posted in 2013 include what the Archive believes is the agency's first formal acknowledgement that it helped plan and execute the coup; accounts of who did what differ.
National Security Archive: CIA Confirms Role in 1953 Iran Coup ↗
CIA released about 1,400 pages on its 1954 coup operation in 1997, including an assassination guide found in training files.
After the Petrovs' defection the Commission found the 'Petrov Papers' authentic and the Soviet Embassy used for espionage; it recommended no prosecutions.
In summer 1954 Israeli military intelligence recruited Egyptian Jews to plant bombs in Egypt in a false-flag operation codenamed Susannah. Eleven were arrested. Two were condemned to hang and six others received long prison terms.
A Senate staff report documents FBI covert action programs against domestic groups from 1956 until the Bureau ended them in 1971.
Israel State Archives records that Israeli agents captured Eichmann in Argentina and Mossad agents handed him to the police in Israel.
Israel State Archives: Behind the scenes at the Eichmann Trial ↗
A FOIA lawsuit by the National Security Archive obtained release of volumes of CIA's internal history of the 1961 invasion.
National Security Archive: Top Secret CIA 'Official History' of the Bay of Pigs ↗
A TOP SECRET Joint Chiefs memo forwarded Cuba Project pretext ideas and calls itself preliminary and for planning purposes. Not a CIA plan; no claim it was carried out.
National Security Archive: Joint Chiefs pretexts to invade Cuba ↗
Cambridge graduates were recruited by Soviet intelligence in the 1930s. The National Archives publishes MI5 records in which Kim Philby gave a partial confession on 11 January 1963 and Anthony Blunt confessed on 23 April 1964. Blunt was given immunity from prosecution in return for confessing.
The National Archives: Confessions from the Cambridge Five ↗
The National Archives: Anthony Blunt’s confession ↗
The National Archives: latest release of MI5 files (14 Jan 2025) ↗
NSA declassified 140+ documents in 2005; its historian's study says signals intelligence shows a reported second attack on 4 August 1964 did not occur.
National Security Archive: Tonkin Gulf press release (1 Dec 2005) ↗
A classified Defense Department study of US decision-making in Vietnam was leaked to the press and first published by The New York Times on 13 June 1971. The government tried to stop publication, and the Supreme Court decided the case on 30 June 1971.
U.S. National Archives: Pentagon Papers ↗
After eight members of Black September killed Israeli athletes and coaches at the 1972 Munich Olympics, Mossad chief Zvi Zamir told CBS’s 60 Minutes that Prime Minister Golda Meir told him to draw up a list of targets. CBS reported that Mahmoud Hamshari was killed in Paris by a bomb in his telephone, and that other suspected militants then “started dropping”, including in Cyprus and Athens.
On 21 July 1973 a team of Israeli agents shot dead Moroccan waiter Ahmed Bouchikhi in the Norwegian resort of Lillehammer. Five were convicted and jailed in Norway. In 1996 Israel agreed to compensate his family without taking responsibility, and in 2000 a Norwegian commission concluded Mossad acted without Norwegian help.
The Guardian: Norway solves riddle of Mossad killing (1 Mar 2000) ↗
JTA: Israel to compensate family of Moroccan killed by Mossad (28 Jan 1996) ↗
On 24 April 1974 Günter Guillaume, an aide in the West German Chancellery, was arrested in Bonn. He was an officer on special assignment of the East German Ministry for State Security. Chancellor Willy Brandt resigned on 6 May 1974, taking political responsibility.
Bundesarchiv: Die Affäre Guillaume (German) ↗
Willy-Brandt-Stiftung: Die Guillaume-Affäre und der Rücktritt Willy Brandts (German) ↗
A Senate select committee published an interim report on alleged assassination plots involving foreign leaders, including Congo planning.
FBI records identified DINA agents as responsible; a declassified 1987 CIA assessment is characterised by the Archive as concluding Pinochet personally ordered it. Newer FBI records were posted in 2026.
National Security Archive: CIA: 'Pinochet personally ordered' ↗
National Security Archive: The Letelier-Moffitt Case at 50 ↗
At a Senate hearing the CIA Director said seven boxes of MKULTRA finance records had been found; the hearing record says at least one death resulted from unwitting LSD tests.
Operation RYaN, a Russian acronym for “nuclear missile attack”, was launched in 1981 to anticipate a surprise nuclear strike by monitoring indicators from NATO and the United States. KGB reports for 1981 and 1982 posted by the National Security Archive describe it as the largest peace-time intelligence-gathering operation in history. In 1983 Andropov told KGB residencies it had acquired “an especial degree of urgency”.
National Security Archive: The 1983 War Scare, Part I (EBB 426) ↗
Wilson Center: Crying Wolf? Project RYaN and the 1983 ‘War Scare’ ↗
On 22 September 1985 the French Prime Minister said French secret agents sank the Greenpeace ship on orders; the Defence Minister and DGSE director left their posts.
Jonathan Pollard, a former Navy intelligence analyst, was arrested on 21 November 1985 after trying to gain asylum at the Israeli Embassy in Washington. He pleaded guilty in 1986 to conspiracy to commit espionage and was given a life sentence in 1987. He was released on parole in November 2015 with a requirement to stay in the United States for five years.
CBS News: Israeli spy Jonathan Pollard freed from US prison ↗
NBC News: US grants parole to Jonathan Pollard (28 Jul 2015) ↗
Mordechai Vanunu, a former nuclear technician, gave the Sunday Times an account of activity at Israel’s Dimona facility in 1986. An Israeli court convicted him of treason and spying on 24 March 1988. He served about 17½ years, much of it in solitary confinement, according to the LA Times.
UPI: Israeli court convicts nuclear technician of treason, spying (24 Mar 1988) ↗
Former MI5 officer Peter Wright claimed in Spycatcher that thirty MI5 officers had approved a plot against Prime Minister Harold Wilson. MI5 ordered a fresh internal inquiry. On BBC Panorama on 13 October 1988 Wright said the maximum number was “eight or nine”, often only three, and that when it came to it only “One, I should say” was serious.
The Guardian: Rimington on Spycatcher and freedom of information (11 Sep 2001) ↗
ECHR Commission report: Times Newspapers Ltd and Neil v UK (PDF) ↗
In 1990 the European Parliament adopted a resolution on a clandestine parallel intelligence and armed-operations organisation revealed in several member states, which it said was run by state secret services in collaboration with NATO. It condemned the networks and called for a full investigation.
Wikisource copy: European Parliament resolution on Gladio (1990) ↗
The Churchill Archives Centre states KGB archivist Mitrokhin, his family and his notes were exfiltrated by SIS in 1992; the files opened to researchers in 2014.
The Deputy Secretary of Defense announced the declassification of the existence of the National Reconnaissance Office; nothing else was declassified at that time.
In October and November 1986 two secret US operations were exposed: arms sales to Iran and support for the Contras in Nicaragua. Independent Counsel Lawrence Walsh’s final report says the operations were carried out with the knowledge of, among others, President Reagan, Vice President Bush, Secretary Shultz, Defense Secretary Weinberger and CIA Director Casey. Bush pardoned Weinberger and others on 24 December 1992.
Executive Order 12951 directed that imagery from the CORONA, ARGON and LANYARD missions be declassified and moved to the National Archives.
On 6 March 1988 SAS soldiers shot dead Mairead Farrell, Daniel McCann and Sean Savage, suspected members of an IRA active service unit, in Gibraltar. On 27 September 1995 the European Court of Human Rights held by ten votes to nine that there had been a violation of Article 2, the right to life. Security Service officers were part of the surveillance and operations group.
US agencies released translations of 1940s KGB and GRU messages; the first 49 messages concerned espionage against the atomic bomb program.
The High Court held the 'necessity' defence cannot be a source of authority for directives permitting physical interrogation methods; it may still be available to an individual interrogator.
The FBI records that the DIA's top Cuba analyst was arrested for spying for Cuban intelligence; she pleaded guilty in 2002 and was sentenced to 25 years.
Five men were convicted in Miami of acting as unregistered foreign agents and related counts; Amnesty reports they were among agents said to have been headed by Cuba's Directorate of Intelligence.
The European Court of Human Rights found it established that the Egyptian imam was abducted in Milan by CIA agents with the cooperation of Italian officials and moved to Egypt.
On 10 April 2004 a sitting president released a portion of his daily brief for the first time: the page-and-a-half 'Bin Ladin Determined To Strike in US'. Whether it amounted to a warning was disputed.
Dr David Kelly, a government weapons expert identified as the source of a BBC report on Iraq intelligence, was found dead in woods near his Oxfordshire home in 2003. Lord Hutton concluded that Dr Kelly took his own life and that no other person was involved. In 2011 the Attorney General declined to seek a fresh inquest, calling the evidence of suicide “overwhelming” and rejecting claims of a cover-up.
Hutton report, chapter 12: conclusions (GlobalSecurity copy) ↗
BBC: Key points of the Hutton report (28 Jan 2004) ↗
BBC: Attorney general rules against Dr David Kelly inquest (9 Jun 2011) ↗
Katharine Gun, a former GCHQ translator, was charged under the Official Secrets Act with leaking a memo about an alleged US “dirty tricks” campaign to spy on UN delegates before the Iraq war. On 25 February 2004 the Crown offered no evidence and a formal not-guilty verdict was recorded. She said she had no regrets and would do it again.
Opposition politician Kim Dae-jung was kidnapped from Tokyo in 1973. South Korea’s National Intelligence Service Truth Committee, established in November 2004, confirmed that the kidnapping was led by the KCIA, the NIS’s predecessor.
Dong-A Ilbo: Truth Committee on the Kim Dae-jung kidnapping (25 Oct 2007) ↗
Yonhap: Park Chung-hee may have tacitly approved (24 Oct 2007) ↗
CIA declassified the 693-page file compiled on a 1973 order of the then-Director, which the Archive describes as a record of illegal activities.
Hamas military leader Mahmoud al-Mabhouh was found dead in a Dubai hotel room in January 2010. Dubai police named 11 suspects holding valid European passports, later saying there were 26 suspects. Dubai’s police chief said he was “100 percent” sure Mossad was behind it.
CNN: Dubai police identify 11 suspects (15 Feb 2010) ↗
CNN: Dubai police chief says Mossad should be ‘ashamed’ (28 Feb 2010) ↗
In July 2010 media partners reported on more than 90,000 US military records from the war in Afghanistan. In October 2010 they reported on almost 400,000 field reports from Iraq, which reporters and analysts used to count incidents and casualties.
The Guardian: Afghanistan war logs ↗
The Guardian: the true civilian body count in Iraq ↗
Five news outlets began publishing stories from 251,287 US State Department cables dated 1966 to 2010, redacting material before publication. The BBC reported 274 diplomatic posts in the set.
The Guardian: how the US embassy cables leaked ↗
The FBI arrested ten SVR 'illegals' after a decade-long case; they pleaded guilty to conspiring to act as unlawful agents. The FBI says they never obtained classified documents.
At a Chicago federal trial in May 2011, confessed Mumbai-attack scout David Coleman Headley testified that he had met an officer of Pakistan’s ISI whom he called “Major Iqbal” to review the targets and plans. He said Iqbal told him in June 2008 to add the Chabad House to the list because it was “used as a front for the Mossad”.
ProPublica: Headley testifies about meeting with Pakistani officers (24 May 2011) ↗
NBC News: Informant says Pakistani officer wanted Jewish center on list ↗
Hackers took emails from the private intelligence-analysis firm Stratfor, and about five million were posted to WikiLeaks in 2012. A hacker was prosecuted for the intrusion.
Ars Technica: LulzSec member sentenced to 10 years for hacking Stratfor ↗
Belfast solicitor Patrick Finucane was shot dead at his home on 12 February 1989; the UFF claimed responsibility. The third Stevens enquiry concluded: “I conclude there was collusion in both murders”, and said both killings could have been prevented. The 2012 de Silva review found “a series of positive actions” by state agents that “actively furthered and facilitated his murder”.
Stevens Enquiry 3: Overview and recommendations (PDF, via Pat Finucane Centre) ↗
GOV.UK: The report of the Patrick Finucane Review (12 Dec 2012) ↗
A judicial commission failed to identify the journalist's killers and found police had not questioned military-intelligence officials. Responsibility is unresolved.
A June 2012 New York Times report by David Sanger, reproduced by NBC News, said the Stuxnet worm that disrupted Iran’s Natanz enrichment plant was developed by the United States and Israel under a programme code-named Olympic Games. It said the worm escaped Natanz and spread worldwide in the summer of 2010.
NBC News (copy of NYT/Sanger): Obama order sped up wave of cyberattacks against Iran ↗
Al Jazeera published what it said was the commission's leaked report, attributing bin Laden's nine years in Pakistan to a 'collective failure'; it was not officially released.
The Guardian published a FISC order to Verizon in June 2013; in 2015 the Second Circuit held Section 215 did not authorize the bulk program, without deciding the constitutional question.
A less-redacted CIA history of the U-2 and OXCART programs was released under FOIA, with a declassified map of the Groom Lake test site.
National Security Archive: The Secret History of the U-2 and Area 51 ↗
On 21 June 2013 the Guardian reported, citing documents from Edward Snowden, that GCHQ had tapped fibre-optic cables under a programme codenamed Tempora and could store the data for up to 30 days. In 2021 the European Court of Human Rights Grand Chamber ruled in Big Brother Watch v UK that the UK’s bulk interception regime and its communications-data regime violated Article 8 of the Convention.
The Guardian: GCHQ taps fibre-optic cables (21 Jun 2013) ↗
ECtHR press summary: Big Brother Watch v UK, Grand Chamber (25 May 2021) ↗
Prompted by events involving Kim Dotcom, the review identified assistance to other agencies concerning 88 individuals between 2003 and 2012 that raised legal-compliance questions.
The Guardian published a secret court order requiring a Verizon unit to give the NSA call records on an ongoing basis. Three days later the source identified himself as Edward Snowden.
The Guardian: NSA collecting phone records of millions of Verizon customers ↗
The Guardian: Edward Snowden, NSA files source ↗
A 41-slide NSA presentation described a program called Prism that collected communications from US internet companies. The companies named in the slides said they did not know of such a program.
The Guardian: NSA Prism program taps into user data of Apple, Google and others ↗
Prosecutors and gendarmes sought to search trucks accompanied by MİT officials; testimony reviewed by Reuters described arms parts, while the government said humanitarian aid. The load remains disputed.
The Inspector-General concluded NZSIS's 2011 release to a blogger about a briefing to Phil Goff was incomplete, inaccurate and misleading.
Judgment 24/2014 annulled in relevant parts the 2013 judgment convicting Nicolò Pollari and four others, finding the Prime Minister's secrecy powers had been infringed.
About 40GB of material attributed to the surveillance-software maker Gamma Group, which sells FinFisher, was posted online in August 2014. ProPublica reported that experts it consulted believed the documents were genuine.
ProPublica: leaked docs show spyware used to snoop on U.S. computers ↗
The Senate Intelligence Committee published its study of the program, with a foreword by Chairman Feinstein and additional and minority views.
In September 2014 reservists who served in Unit 8200 addressed a letter to the Prime Minister, the Chief of Staff and the commander of the unit saying they refuse to take part in actions against Palestinians. The Guardian published the letter and counted 34 signers; JTA reported 43 reservists, including 10 officers. The IDF called it exploitation of military service to express a political position.
The Guardian: Israeli intelligence veterans’ letter in full (12 Sep 2014) ↗
JTA: IDF and fellow reservists condemn refusal letter (14 Sep 2014) ↗
The prosecutor was found dead days after accusing the president over the AMIA case; investigators had not determined suicide or murder, and the intelligence agency's role is disputed.
The tribunal ruled the regime governing UK access to NSA-intercepted material breached human-rights law until 2014 because safeguards were not public.
More than 400GB of internal documents, emails and source code from the Italian spyware vendor Hacking Team was published after a breach. The material included a list of the countries that bought its Da Vinci surveillance tool.
BBC News: hackers steal data from surveillance company ↗
Wired: Hacking Team breach shows a global spying firm run amok ↗
WikiLeaks began publishing what it said were more than 500,000 Saudi foreign ministry documents, with about 60,000 posted at first. The Associated Press said it could not immediately verify the documents.
Associated Press: WikiLeaks publishes secret Saudi files ↗
Al Jazeera: Saudi Arabia warns against sharing faked cables ↗
The Intercept published an eight-part series based on documents about the US military drone program. It reported that in one five-month period about 90 percent of the people killed were not the intended targets.
PBS NewsHour: whistleblower comes forward with documents on the drone program ↗
On 4 June 2015 the US Office of Personnel Management disclosed an intrusion potentially affecting about 4.2 million current and former federal employees. Later that month it reported a separate incident that compromised sensitive background-investigation information on 21.5 million individuals. A Congressional Research Service brief says some have cited China as the source.
Congressional Research Service R44111: Cyber Intrusion into OPM (PDF) ↗
As reported by The Guardian, the Iraq Inquiry criticised the Joint Intelligence Committee and MI6 over flawed intelligence on Iraq's weapons programmes.
The Federal Court examined a CSIS metadata retention program running since 2006 and noted the Court had never before been fully informed of it.
Stolen emails and documents from Democratic Party committees and a presidential campaign were released online under the names Guccifer 2.0 and DC Leaks. In July 2018 the US Justice Department indicted 12 Russian military intelligence officers over the intrusions.
PBS NewsHour: full indictment of 12 Russian officers ↗
U.S. Justice Department announcement (text via Wikisource) ↗
From August 2016 a group calling itself the Shadow Brokers published hacking tools said to belong to the Equation Group, the cyber-espionage actor Kaspersky described in 2015. A further release on 14 April 2017, "Lost in Translation", contained exploits later used in the WannaCry ransomware outbreak.
Rapid7: the Shadow Brokers leaked exploits FAQ ↗
Microsoft: WannaCrypt ransomware worm targets out-of-date systems ↗
Check Point Research: analysing the leaked tools ↗
Check Point Research: EternalBlue, everything you need to know ↗
Kaspersky: Equation Group, the crown creator of cyber-espionage ↗
The World Anti-Doping Agency said a Russian cyber-espionage group had broken into its ADAMS database and that confidential athlete data was being published. It said the group got in using credentials obtained by spear-phishing.
The UK public inquiry found the poisoning was carried out by two men probably under FSB direction and approved by its chief and President Putin. These are 'probably' findings.
On 27 May 2016 an Argentine federal court in Buenos Aires announced guilty verdicts against military officers for taking part in Operation Condor, the coordinated cross-border repression of South American military regimes. The National Security Archive provided declassified evidence to prosecutors, including a declassified FBI document.
National Security Archive: Operation Condor verdict (27 May 2016) ↗
National Security Archive: Operation Condor trial documents (EBB 514) ↗
A German parliamentary inquiry presented its final report on 28 June 2017 on US spying in Germany and Germany’s spying on its allies. Investigators found the BND had cooperated with the NSA and kept tabs on allies, using “selectors”, search terms for dragnet surveillance.
Deutsche Welle: NSA spying scandal committee presents final report (28 Jun 2017) ↗
Kim Jong Nam, the half-brother of North Korea’s leader, was attacked at Kuala Lumpur airport on 13 February 2017. Malaysian authorities identified the nerve agent VX on 24 February. On 27 February 2017 South Korean lawmakers said the country’s National Intelligence Service told them four North Korean suspects were spies from North Korea’s Ministry of State Security.
A trove of emails and documents tied to a French presidential campaign appeared online just before the 2017 run-off. The question was whether it came from a Russian state group.
Associated Press: French agency cannot attribute the Macron leak ↗
EUobserver: Macron leaks could be isolated individual, France says ↗
The Intercept published an NSA memo about a Russian attack on a US voting-software supplier. A contractor was charged shortly afterwards.
WikiLeaks began publishing what it called a trove of CIA cyber-espionage documents, 8,761 documents and files by its own count. The CIA at first had no comment and later gave an expanded response claiming no wrongdoing.
NPR: WikiLeaks releases what it calls CIA trove ↗
Defense One: CIA claims no wrongdoing ↗
WikiLeaks published what it said was source code for Hive, a CIA command-and-control system for implants, in a series it called Vault 8. Trade press reported the release on 9 November 2017 and described the material as alleged.
Libyan dissident Abdel Hakim Belhaj and his wife Fatima Boudchar were seized in Thailand in 2004 and flown to Libya. On 10 May 2018 the Attorney General read the Prime Minister’s letter in the Commons: the Government’s actions “contributed to your detention, rendition and suffering”, and “I apologise unreservedly”. Boudchar received £500,000 in a settlement.
Hansard: Belhaj and Boudchar litigation update (10 May 2018) ↗
The Guardian: Britain apologises for ‘appalling treatment’ of Belhaj ↗
On 30 April 2018 Israeli Prime Minister Benjamin Netanyahu presented what he said were copies of 55,000 pages of Iranian nuclear information and 55,000 files on discs. He said the originals were “in a very safe place” and gave no details of how Israel obtained them. Iran’s deputy foreign minister called it “childish”.
CNN: Netanyahu says Israel has proof of Iran’s nuclear programme (30 Apr 2018) ↗
The NotPetya cyberattack of June 2017 spread worldwide, with Ukraine among the primary targets. On 15 February 2018 the UK government judged that the Russian Government, specifically the Russian military, was responsible. The White House issued a statement the same day saying the Russian military launched the attack.
GOV.UK: Foreign Office minister condemns Russia for NotPetya attacks ↗
White House: Statement from the Press Secretary (15 Feb 2018) ↗
The Guardian reports ASIS officers were told to bug Timor-Leste's offices during treaty talks; the government has not, in the cited source, confirmed it. A former officer and his lawyer were charged.
On 13 July 2018 twelve Russian intelligence officers were accused in an indictment from the Mueller investigation of trying to interfere in the 2016 US election, including a hack of the Democratic National Committee. The indictment says they worked for the GRU and released tens of thousands of documents under pseudonyms such as “Guccifer 2.0” and “DC Leaks”. The Senate Intelligence Committee released Volume 5 of its bipartisan Russia report on 18 August 2020.
PBS NewsHour: Mueller’s indictment of 12 Russian officers (13 Jul 2018) ↗
Senate Intelligence Committee: Volume 5 release (18 Aug 2020) ↗
The Justice Department Inspector General identified 17 significant inaccuracies and omissions in FBI applications to surveil Carter Page.
Five were sentenced to death behind closed doors; then-deputy intelligence chief al-Asiri was tried and released for insufficient evidence. A UN investigator called it a 'mockery' of justice.
Pakistan’s military court sentenced Indian national Kulbhushan Jadhav to death in April 2017 on espionage-related charges. India filed at the International Court of Justice on 8 May 2017. On 17 July 2019 the Court found Pakistan had breached its obligations under Article 36 of the Vienna Convention on Consular Relations.
International Court of Justice: Jadhav (India v. Pakistan), case 168 ↗
From March 2019 an anonymous persona posted tools, victim data and claims about operators of the Iran-linked hacking group known as APT34 or OilRig. Security firms analysed what was posted.
BleepingComputer: hacker group exposes Iranian APT operations ↗
Wired: Iran hackers OilRig, read my lips ↗
SecurityWeek: source code of Iran-linked hacking tools posted online ↗
Recorded Future Insikt Group report on Iranian leak groups (Jan 2024) ↗
A Turkish court sentenced the exiled editor to more than 27 years for espionage-related and terrorism-support charges. It is a court ruling, not a finding about what the trucks carried.
The court held German intelligence is bound by the Basic Law even in foreign-to-foreign surveillance and declared provisions of the BND Act incompatible with it.
According to ZDF and The Washington Post, the Swiss encryption firm was secretly owned by the CIA and the BND; the Archive posted related declassified records.
OPCW confirms a cholinesterase-inhibitor with similarities to scheduled chemicals; the link to an FSB unit rests on Bellingcat's open-source reporting.
On 14 July 2020 the UK banned the purchase of new Huawei 5G equipment after 31 December 2020 and ordered all Huawei 5G kit removed by the end of 2027. GOV.UK says the decision followed a technical review by the National Cyber Security Centre in response to US sanctions. The NCSC says a May 2020 US sanction caused it to modify its security mitigation strategy for Huawei.
GOV.UK: Huawei to be removed from UK 5G networks by 2027 ↗
A Belgian court sentenced Iranian diplomat Assadollah Assadi to 20 years for a foiled 2018 bomb plot; Tehran denies ordering it.
A reporting consortium analysed a list of more than 50,000 phone numbers it believed had been selected by clients of the spyware firm NSO Group as people of interest since 2016. NSO strongly denies the claims.
The Guardian: leak uncovers global abuse of cyber-surveillance weapon ↗
The review found 28% of requests were not sufficiently justified to warrant release, yet CSE approved 99% of requests from domestic clients.
NZSIS published its 135-page internal review: systems 'broadly effective' with five areas to improve; the attacker was a lone actor who concealed his plans.
On 19 July 2021 Amnesty International and media partners reported a leak of 50,000 phone numbers of potential surveillance targets linked to NSO Group’s Pegasus spyware. NSO “firmly denies” the allegations. In WhatsApp v NSO, a US jury awarded compensatory and punitive damages, later cut by the judge, with a permanent injunction entered in 2025.
The archive of more than 111 km of files and 1.7 million photos has been part of the Federal Archives since 17 June 2021.
ODNI released an assessment that the Crown Prince approved an operation to 'capture or kill' Khashoggi; Saudi Arabia rejects it. An intelligence judgment, not a court finding.
A technical committee reporting to India’s Supreme Court examined 29 phones in the Pegasus allegations. According to The Hindu, it found “some malware” in five of them but said this does not mean it is Pegasus. The report said the Government of India did not cooperate.
The Hindu: Of 29 phones examined, five infected with some malware (25 Aug 2022) ↗
A hacktivist group posted emails taken from a server of Iran's atomic energy body during protests that followed the death of Mahsa Amini. It threatened to release more unless detained protesters were freed.
BleepingComputer: Iran's atomic energy agency confirms hack ↗
The Record: Iran blames a specific foreign country for the leak ↗
CyberScoop: Iran government hack-and-leak and hacktivist personas ↗
On 13 January 2022 MI5 issued its first interference alert relating to China, naming UK lawyer Christine Ching Kui Lee. The alert says she “knowingly engaged in political interference activities on behalf of the United Front Work Department” of the Chinese Communist Party. The Chinese embassy accused MI5 of “smearing and intimidation”.
The Guardian: Chinese national trying to improperly influence politicians, says MI5 (13 Jan 2022) ↗
The US Justice Department charged Yanjun Xu, a deputy division director in the Jiangsu State Security Department’s Sixth Bureau, with economic espionage targeting GE Aviation. He was arrested in Belgium and extradited. A jury in Cincinnati convicted him in November 2021 and he was sentenced to 20 years on 16 November 2022.
US DOJ: Chinese intelligence officer charged with economic espionage (10 Oct 2018) ↗
NPR: Chinese intelligence officer sentenced to 20 years (16 Nov 2022) ↗
The State Capture commission's Part V covers the SSA; Daily Maverick reports it found the Special Operations Unit ran unconstitutional operations costing millions of rands.
In 2022 the NGO Safeguard Defenders reported that public security bureaus from two Chinese provinces had set up 54 “overseas police service centres” in 21 countries. On 17 April 2023 the US Justice Department announced the arrest of two men, Lu Jianwang and Chen Jinping, over an alleged overseas police station in New York. The Chinese embassy in Canada described such sites as “service stations” staffed by volunteers who are not police officers.
US DOJ: Two arrested for operating illegal overseas police station (17 Apr 2023) ↗
The Guardian: Canada investigates secret Chinese police stations (27 Oct 2022) ↗
Canada's then-PM cited credible allegations potentially linking India; India called them absurd. In July 2026 an RCMP official was reported saying no evidence linked Indian officials. Unresolved.
As the genuine Discord documents spread, pro-Kremlin Telegram channels widely circulated an image edited to reduce Russian troop deaths and inflate Ukrainian losses. Some of those channels and outlets then suggested the whole set was at least partly fake.
Kaspersky said its staff's iPhones had been infected by previously unknown malware in a campaign it called Operation Triangulation. The FSB said the same day that thousands of devices were hit and accused the NSA and Apple of cooperating.
Kaspersky: new mobile APT campaign targeting iOS devices ↗
TechCrunch: Kaspersky says attackers hacked staff iPhones ↗
BleepingComputer: Russia says US hacked thousands of iPhones ↗
Classified US military documents, including some about the war in Ukraine, were shared in private Discord chat groups and spread from there to other platforms. The FBI arrested an Air National Guard member in April 2023.
Reuters: Pentagon leaker Teixeira sentenced to 15 years ↗
Bellingcat: from Discord to 4chan, the journey of a US defence leak ↗
Documents dated 2016 to 2021 from a Moscow IT contractor described tools for cyber operations, disinformation and control of critical infrastructure. Five Western intelligence agencies told the reporters the files appeared authentic.
The Guardian: Vulkan files leak reveals Putin's cyberwarfare tactics ↗
Der Spiegel: a look inside Putin's secret plans for cyber warfare ↗
Google Cloud / Mandiant: cyber operations at a Russian contractor ↗
On 20 June 2023 a federal jury in Brooklyn convicted three defendants of acting or conspiring to act in the US as illegal agents of the PRC. The Justice Department said they were the first defendants convicted after a US trial in connection with the PRC’s repatriation programme “Operation Fox Hunt”. Michael McMahon, a retired NYPD sergeant, was convicted of acting as an illegal agent.
US DOJ via GlobalSecurity: Retired NYPD sergeant and co-conspirators convicted (20 Jun 2023) ↗
On 4 February 2023 US fighter aircraft brought down a high-altitude balloon off the coast of South Carolina. Defense Secretary Lloyd Austin’s statement called it a PRC surveillance balloon used “in an attempt to surveil strategic sites”. China’s foreign ministry said it was a civilian airship used mainly for meteorological research that had strayed off course.
US Mission China: Statement from Secretary of Defense Austin (4 Feb 2023) ↗
PBS NewsHour/AP: China says balloon was meteorological and strayed ↗
Police searches targeted the former ABIN director over suspected use of FirstMile software to monitor targets; he denied it. In 2025 police indicted him and others. These are allegations.
The FBI lists five Russian military intelligence officers and one civilian as wanted for alleged computer intrusion between December 2020 and August 2024. US federal arrest warrants were issued in Maryland on 7 August 2024 for conspiracy to commit computer intrusion and damage, and wire fraud conspiracy. The State Department’s Rewards for Justice program offers up to $10 million for information on their location.
On 31 March 2024 The Insider, with 60 Minutes and Der Spiegel, published an investigation suggesting that anomalous health incidents, often called Havana syndrome, may originate with directed-energy weapons used by members of GRU Unit 29155. A 2023 US government assessment had said it was “very unlikely” a foreign adversary was responsible, while acknowledging some agencies had only low or moderate confidence.
An audio recording of German Air Force officers discussing the war in Ukraine, including whether Taurus cruise missiles could destroy a bridge, was published on Telegram by RT's chief. The German Defense Ministry confirmed the recording was genuine.
A seller on a hacker forum offered what he called classified Europol data. Europol confirmed a breach of its web portal for experts but said no operational data had been compromised.
BleepingComputer: Europol confirms web portal breach ↗
SecurityWeek: Europol investigating breach after hacker offers to sell classified data ↗
Internal files of the Shanghai company i-Soon, a contractor for Chinese security bodies, appeared on GitHub in February 2024. They included marketing documents and chat messages between staff and clients.
Associated Press: Chinese cybersecurity leak document dump ↗
SentinelOne: unmasking i-Soon ↗
The Record: China's commercial hacking industry and the i-Soon leaks ↗
Two top-secret US intelligence documents, attributed to the NGA and NSA, assessing Israeli military preparations against Iran were posted on Telegram in October 2024. They were marked as shareable with the Five Eyes countries.
Associated Press: US investigating unauthorized release of documents on Israel's Iran attack plan ↗
In September 2024 thousands of pagers and radios used by people associated with Hezbollah exploded in Lebanon. The Times of Israel reported the two days of attacks killed 39 people and wounded more than 3,400. On 11 November 2024 Prime Minister Netanyahu’s office confirmed Israel was behind the pager attacks.
Times of Israel: Netanyahu’s office confirms Israel was behind the pager attacks (11 Nov 2024) ↗
AP: UN rights chief on the Lebanon explosions ↗
OHCHR: UN experts on exploding pagers and radios (19 Sep 2024) ↗
Operation Kenova, led by Jon Boutcher, investigated murders and other offences linked to an alleged agent code-named Stakeknife in Northern Ireland. Its 2024 interim report describes a “maverick culture where agent handling was sometimes seen as a high-stakes ‘dark art’ practised ‘off the books’”. Boutcher writes that he thinks it “probable” that continuing the agent’s operation lost more lives than it saved.
The US charged a man it describes as a former Indian government official with directing a foiled murder-for-hire plot in New York. An indictment is an allegation.
On 7 February 2024 CISA, the NSA and the FBI issued an advisory assessing that People’s Republic of China state-sponsored cyber actors are seeking to “pre-position” themselves on IT networks for disruptive or destructive attacks on US critical infrastructure in the event of a major crisis or conflict. The agencies said Volt Typhoon’s pattern of behaviour is not consistent with traditional espionage.
CISA advisory AA24-038a: PRC state-sponsored actors compromise US critical infrastructure ↗
The National Archives released MI5 files with new detail on Philby, Blunt and Cairncross, including their confessions.
The UK inquiry chair concluded the 2018 operation against Sergei Skripal must have been authorised by President Putin; the UK sanctioned the GRU. Russia rejects the findings.
Canada’s Public Inquiry into Foreign Interference, led by Commissioner Marie-Josée Hogue, dated its final report 28 January 2025. The summary says the PRC poses the most sophisticated and active cyber threat to Canada. It describes India as the second most active country engaging in electoral foreign interference, and Pakistan’s activities as opportunistic.
Public Inquiry into Foreign Interference: Final Report Vol. 1 (PDF) ↗
Under a presidential directive the National Archives released all JFK records previously withheld for classification (18 March 2025) and began rolling RFK releases.
A leak of more than 100,000 documents from the Chinese company Geedge Networks was reported in September 2025. Journalists and researchers said the company sells censorship and surveillance systems modelled on the Great Firewall to governments including Myanmar and Pakistan.
Wired: massive leak shows a Chinese company exporting the Great Firewall ↗
Amnesty International: Pakistan's mass surveillance and censorship machine ↗
A persona called Handala claimed in February 2025 to hold 2.1TB (350,000 files) from Israeli police, and in December 2025 to have breached Telegram accounts of senior officials. Researchers who checked the December claim found it overstated.
Internal Intellexa files were published by a media consortium that said they show the Predator spyware vendor could remotely access customer systems. A Greek trial over the Predator affair is ongoing.
Amnesty International Security Lab: Intellexa Leaks ↗
TechCrunch: Intellexa had direct access to government espionage victims ↗
In November 2025 data was reported to have leaked from the Chinese cybersecurity contractor Knownsec. Vendors described a collection of internal files and said a copy posted to GitHub was removed.
An article in Phrack described about 9GB of data said to have been taken in June 2025 from the workstation of a hacker who targeted South Korean systems. The authors alleged the operator was the North Korean group Kimsuky.
Intel 471: the Phrack leak, examining an APT's workstation ↗
A joint advisory by the NSA, CISA, the FBI and partners including Australia’s cyber agency describes Chinese state-sponsored activity against telecommunications, government, transportation, lodging and military networks. The advisory says this activity “partially overlaps” with industry reporting commonly called Salt Typhoon. It says the companies involved provide services to China’s intelligence services, including multiple units in the PLA and MSS.
In a per curiam opinion dated 17 January 2025 the US Supreme Court upheld the law requiring TikTok’s US operation to be severed from Chinese control, rejecting a First Amendment challenge. The Court noted that ByteDance is subject to Chinese laws requiring it to “assist or cooperate” with the Chinese government’s “intelligence work”.
US Supreme Court: TikTok Inc. v. Garland, per curiam (PDF) ↗
On 6 August 2025 the Guardian, with Israeli-Palestinian media partners, reported that Unit 8200 used Microsoft’s Azure cloud to store recordings of mobile phone calls by Palestinians. On 25 September 2025 the Guardian reported Microsoft’s Brad Smith saying the company had “ceased and disabled a set of services to a unit within the Israel ministry of defense”.
The Guardian: Microsoft and Israeli military phone calls (6 Aug 2025) ↗
The Guardian: Microsoft blocks Israel’s use of its technology (25 Sep 2025) ↗
Dozens of 1998–2001 presidential briefings were released; NBC reports they show warnings but no definitive information on how or when an attack would occur.
An Argentine judge sent eight suspects, including a former Iranian intelligence minister, to trial in absentia. These are charges; the accused have not been tried.
As reported by the National Catholic Register, the Justice Department called the memo a 'grave failure' of responsibility; the FBI retracted it in 2023.
The Seoul High Court sentenced former director Cho Tae-yong to two years and six months over evidence destruction, political interference and perjury charges linked to the martial-law declaration.
A Greek court convicted four people linked to the marketing of the Predator spyware, which was used to target 87 people including ministers, military officials and journalists. The BBC reported that one in three of the dozens targeted had also been under legal surveillance by Greece’s intelligence service, EYP.
BBC: Greek court convicts four over Predator spyware scandal (26 Feb 2026) ↗
The US Justice Department alleges Xu Zewei worked as an MSS contractor in cyberattacks; he was extradited from Italy and has not been tried on these facts.
A seller on a hacker forum advertised what was described as 3.5TB of NATO-related defence data. Cybernews reported on the listing in May 2026.
The extortion group ShinyHunters claimed to hold data tied to the FBI's jobs site. The FBI said it was investigating, and the group later said it would not publish the data.
MI5 publicly stated that the China General Technology Research Institute is a front for China's MSS. These are MI5's assertions, not tested in court.
The review agency says CSIS may not have complied with the law when using its authority to commit offences in 2022–2023; no final determination is stated in the coverage.
A Rome court sentenced three Egyptian officials in absentia to 10 years for aggravated kidnapping; one is named as from Egypt's General Intelligence. Egypt denies state involvement.
A court suspended the director on suspicion of disclosing classified information in a corruption probe. No one has been convicted.