CIA Contractor Arrested, Accused of Leaking Classified Reports to Romantic Partner's Substack

The FBI on Friday arrested a government contractor who worked for the CIA. The Justice Department says he leaked national defense information to a woman who runs a publication on Substack. According to DOJ, Ian A. Brinksman, 42, of the District of Columbia, was arrested Friday morning after a search of his residence.

The charge. Brinksman is charged by criminal complaint in federal court in Alexandria, Virginia, with one count of transmitting national defense information. The law is 18 U.S.C. § 793(d), part of the Espionage Act. The complaint alleges conduct from March 11 through Oct. 5, 2026, in Fairfax County. The statute carries up to 10 years in prison. In its announcement, the Justice Department wrote: "Charges in a complaint are merely allegations, and every defendant is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law."

In court. According to the court docket, Brinksman made his initial appearance Friday before U.S. Magistrate Judge William E. Fitzpatrick. The government sought detention, and the judge granted it. A preliminary and detention hearing is set for Oct. 27. The court appointed the Federal Public Defender's office to represent him. A federal public defender representing Brinksman declined to comment to Reuters.

What the affidavit alleges. The case rests on a 13-page affidavit by FBI Special Agent John W. Althen. The affidavit identifies his employer only as "a U.S. government agency." The CIA connection comes from CIA Director John Ratcliffe, who said in the DOJ release that the agency referred the case. Ratcliffe described Brinksman as "a contractor who provided services to CIA."

His job and clearance:

• He worked for the agency as an employee beginning in or around 2020.
• In or around September 2022, he joined a contractor ("Company 1") as a developer for systems integration.
• He held a TS/SCI clearance throughout.
• In a footnote, the agency says his normal duties include data transfers between classified and unclassified systems.

The reports and the articles:

• Brinksman first accessed a classified database in August 2022.
• In 2026, he accessed five classified reports. The affidavit ties each access to phone calls the same day with "Individual 1."
• Individual 1 then published articles "with similar content." Those articles appeared on or about March 11, May 13, May 28, July 29 and Oct. 5, 2026.
• According to the agency, "none of these Reports—Reports 1, 2, 3, 4, or 5—was within the scope of" his work. All five carry TS/SCI banners.
• An "Original Classification Authority" confirmed that each article contains classified information reflecting the matching report.

Other evidence cited:

• Call records show "more than 800 calls or attempted calls" between the two in 2026.
• He was "one of no more than six individuals" who viewed the Substack page from the federal facility between March 1 and Oct. 5. He was the only one of them who viewed all five articles and also accessed the five reports.
• On Oct. 10, agents reviewed a notebook left on his desk and found that "the corners of several pages were torn out."
• Badge records show him leaving his secure workplace shortly after viewing reports. The agent wrote that people at his workplace may not carry phones inside, and that the short windows "would have provided him sufficient time" to go to his vehicle and communicate with Individual 1.

What the affidavit does not allege. It does not describe any directly observed handoff of documents; the case as laid out is built on timing, records and a classification review. It also describes a separate article on Middle East issues that Brinksman allegedly helped edit through a shared Google Document. The affidavit says, "At this point, the government has not identified classified equities in this article." It also says Brinksman "has sought prepublication review for any articles he has co-authored with Individual 1." Prepublication review is required to keep his clearance.

Individual 1. The affidavit and DOJ describe Individual 1 as someone Brinksman has "an ongoing personal relationship" with. They say she maintains a Substack she has called "her new independent publication." According to the affidavit, a September 2026 fundraising article reportedly published by Individual 1 said she had "published reporting based on classified [relevant U.S. government agency] assessments that I believe the public deserves to know about." The affidavit also says she wrote in a public post, "I also accept leaks." The filings do not charge her. Radio Purple is not naming her because DOJ and the court filings do not.

Who is handling the case. The FBI Chicago Field Office is leading the investigation, with help from the Washington Field Office. Prosecutors from the National Security Division and the U.S. Attorney's Office for the Eastern District of Virginia are handling it.

The arrest came the same day the Justice Department announced charges against two former FBI officials over their congressional testimony.