Analytical Essay: Cyber Intelligence and the Dissolving Public-Private Divide
In traditional intelligence disciplines, the United States Intelligence Community (USIC) has owned a monopoly on collection, identification, and attribution of intelligence sources. As the world becomes more distributed and connected, however, the monolithic ownership of the USIC is beginning to become shared across public, private, and nonprofit sectors across the world (Lowenthal 2025). Because cyber intelligence is a burgeoning intelligence discipline, there are very few “rules of the road,” and states have been cautious using strategic restraint in the face of uncertain attackers (Eichensehr 2020). As states grapple to deal with the changing offensive and defensive cyber-landscapes, the USIC is beginning to incorporate these non-governmental sectors as material partners, threat identifiers, and, as this paper proposes, canaries as to how to avoid a catastrophic escalation in an increasingly autonomous world.
Companies, both supporting the USIC and foreign governments, have been eager to get their foot in the door of this new intelligence front. As Harding (2025) puts it, “data [has become] the new oil.” SpaceX handles satellite launches for various parts of the federal government, Cisco builds state-security grade routing hardware, and software-as-a-service platforms, such as Google, have become sources of intelligence through legal and statutory obligations like Section 702 of the Foreign Intelligence Surveillance Act (Harding 2026). The Trump administration has also deputized these private companies, authorizing their ability to “hack back” in certain circumstances (Volz 2026). By blurring the intelligence landscape between “state” and “private,” companies may find themselves in the crosshairs of hostile actors (Lowenthal 2025).
To complicate the problem both the USIC and private sectors face, attribution in the cyber realm is difficult to resolve with certainty. When military hardware is supplied or a satellite is launched, there is usually very little ambiguity of ownership. Cyber intelligence, however, has allowed state actors to hide behind layers of technological protection through VPNs, proxy servers, and dual-purpose private entities (Harding 2025). States wanting to attribute actions face both domestic and external pressures. Attributing a foreign state as a hostile actor can create geopolitical tensions and risk complicating global economic or strategic discussions (RSAC Cybersecurity 2014). Cybersecurity companies, like CrowdStrike, are perhaps better positioned to identify and attribute malicious actors or advanced persistent threat (APT) actors without inflaming geopolitical tensions or stepping into a domestic political spat. For instance, how might the 2016 or 2020 U.S. Presidential elections have fared had it been a private cybersecurity company making the allegations of Russian or Iranian meddling instead of the FBI? Incorporating these private actors can give states some plausible deniability between accusations of state actors (Harding 2025) and the politicization of said intelligence (Lowenthal 2025).
In the cyber world of obfuscation, tactile and kinetic activities still have their place for states to impose their will. Open source intelligence (OSINT) can play a valuable role in attribution for both the digital and “real” world. OSINT is becoming a valuable tool in the intelligence kit by democratizing information collection and analysis with no intrusion, deception, or access needed (Omand 2010). This literal open landscape affords state, nonstate, and private actors the same ability to turn publicly available information into actionable intelligence outcomes. States can deny that they are building up troops or moving surface-to-air missile batteries, but satellite imagery combined with civilian photos posted on social media can offer enough circumstantial evidence to weave together the entire story. In 2014, OSINT nonprofit, Bellingcat, pieced together disparate images posted online to trace the movements of a Buk missile battery that was used to shoot down Malaysia Airlines Flight 17 (MH17) over Ukraine (Allen et al. 2014). While this open source world may be a boon for intelligence services, it also comes with its own drawbacks.
As the dataset on cyber operations methods and strategies grows, supplemented by real-world, open source information, states will need to get used to “fighting in the light” (Harding 2025). An APT that is prone to using the same method of exploitation may begin to leave digital fingerprints of their involvement. FAST16 was identified as a precursor to the infamous Stuxnet due to its similar method of exploit (Kamluk and Guerrero-Saade 2026). There are also first-mover advantages granted to those acting on offense. States tend to be reactive in closing gaps and minimizing intrusions, but offensive actors have the advantage of being able to poke, prod, and modify their attack until it works (RSAC Cybersecurity 2014). In the burgeoning world of AI threats, the speed and intensity at which states could automate their attack increases dramatically.
In the United States, we have already seen companies like OpenAI and Google admit that during AI model training, their models have broken containment and gained unauthorized access to private sector and prodded government servers (Conger et al. 2026). The USIC, therefore, could consider a “Nuclear Test Ban” for AI-led cyber operations. This provides the United States and its intelligence communities with a strategic advantage by applying an internationally agreed-upon brake on AI-led cyber operations, freezing the intelligence landscape before an adversary can gain their own strategic advantage. Although this policy consideration seems like a forfeit of progress, a multinational coalition including great power rivals agreeing not to use artificial intelligence for offense means the USIC can remain the relative hegemon without risking a catastrophic, uncontrolled cyber or kinetic escalation of nuclear rivals. By preempting the reactive firefighting, the United States has the opportunity to set the global precedent in a way that secures its own place, heeding these digital canaries, and avoiding potential hot conflicts powered by the speed of compute.