The FBI isn’t “broken” or “heroic”—it’s a rational actor optimizing for survival in an elite alliance network. That explains both its procedural piety and its clashes with mass movements. If Alliance Theory holds, expecting apolitical neutrality from such an institution is structurally naive.
Rather, the FBI looks less like a neutral law enforcement agency and more like a coalition manager that sits at the intersection of several powerful alliances.
The key question is not “Is the FBI objective?” The better question is “Which alliances does the FBI depend on to maintain its power and legitimacy?”
The FBI occupies a strange structural position. It has legal authority from the state, but it also depends on reputational support from media, courts, and political elites. That makes it what you could call a coalition broker.
It survives by maintaining workable alliances with:
The Department of Justice
Federal courts and prosecutors
Congressional oversight committees
Major media outlets
The broader national security apparatus
Each of these groups can protect or damage the FBI. So the bureau constantly signals loyalty to these audiences.
Alliance Theory predicts that organizations in this position become extremely sensitive to reputational signaling.
The bureau’s deepest alliance is with what you might call the legal-managerial class. This includes federal prosecutors, judges, top law firms, congressional staff, and national security bureaucrats.
These actors share a worldview built around three ideas.
Process legitimacy
Institutional stability
Professional expertise
Because of this alliance structure, the FBI speaks the moral language of procedure. Its public messaging emphasizes rule of law, careful investigation, and institutional norms.
This is not just ethics. It is coalition maintenance. If the FBI loses credibility with judges, prosecutors, and elite lawyers, its cases collapse.
So its messaging constantly signals procedural virtue.
The FBI also maintains a long-standing alliance with prestige media institutions. Think of outlets like The New York Times, Washington Post, CNN, and major network news.
These outlets rely on the FBI for leaks, investigative narratives, and national security framing. In return they often reinforce the bureau’s legitimacy as a guardian institution.
Alliance Theory predicts this kind of relationship.
Information becomes a coalition currency.
Selective leaks, background briefings, and investigative narratives allow the FBI to recruit media allies who amplify its preferred interpretation of events.
When the alliance is strong, the FBI is portrayed as a protector of democracy. When the alliance fractures, the same actions can suddenly be framed as abuse of power.
Donald Trump disrupted the FBI’s alliance equilibrium.
Before 2016, both major parties largely treated the FBI as a neutral prestige institution. Trump instead treated it as a rival coalition actor.
He did three things that threatened the bureau’s alliance structure.
He publicly attacked the bureau’s legitimacy.
He framed investigators as partisan actors.
He encouraged rival coalitions in media and politics to distrust the FBI.
Under Alliance Theory, this creates a predictable response. Institutions defend their legitimacy when a rival coalition threatens it.
That helps explain the intensity of the conflict between Trump’s political coalition and the national security bureaucracy.
Both sides were fighting over the same thing. The right to define institutional legitimacy.
Inside the FBI, status is tied to reputation for professionalism and loyalty to the institution.
Agents gain prestige through:
Major investigations
Successful prosecutions
Reputation for integrity
Internal peer recognition
Alliance Theory predicts that insiders will protect the institution because their status depends on it.
That means criticism from outsiders often triggers defensive solidarity. Internal actors interpret attacks not just as policy disagreements but as threats to their coalition identity.
This is why whistleblowing inside security institutions is rare and costly.
The bureau rewards loyalty to the internal alliance.
Why the FBI often clashes with populist movements
Populist coalitions threaten institutions that derive legitimacy from elite networks.
The FBI’s prestige comes largely from elite validation. Courts, media, and professional organizations certify its legitimacy.
Populist movements derive legitimacy from mass political support instead.
These are two different alliance structures.
One is elite institutional.
The other is mass political.
When these coalitions collide, the FBI tends to align with the institutional side because that is where its status, resources, and legal authority come from.
Alliance Theory predicts exactly this behavior.
What the FBI ultimately protects
At the deepest level, the FBI protects the stability of the American institutional order.
That includes:
The federal legal system
The national security bureaucracy
The legitimacy of state authority
That mission is partly legal and partly coalitional.
If the FBI were perceived as just another partisan tool, its alliance network would collapse. Courts would distrust its evidence, media would treat it as propaganda, and Congress would restrict its power.
So the bureau constantly signals institutional neutrality, even though it inevitably operates inside coalition conflicts.
That tension is structural and permanent.
Alliance Theory does not say the FBI is corrupt or virtuous. It says the bureau behaves like every human coalition organization.
It recruits allies.
It protects status.
It defends its legitimacy when rivals challenge it.
Understanding that dynamic explains far more about the FBI’s behavior than the simple story that it is either an impartial referee or a partisan conspiracy.
The bureau exists as a high-stakes credit clearinghouse. It trades in the currency of investigative files and reputation. You might add that the FBI manages a domestic intelligence market where the primary commodity is the curated narrative.
The technical-bureaucratic firewall
The bureau maintains its coalition by speaking a specialized dialect of technical expertise. This language creates a barrier to entry for outsiders. By framing every action as a result of complex forensic accounting, cyber analysis, or classified human intelligence, the bureau signals to its elite allies that laypeople cannot understand or judge its work. This expertise serves as a defensive wall. It suggests that only those within the legal-managerial class possess the credentials to provide oversight.
The vertical alliance with local law enforcement
While your analysis focuses on elite horizontal alliances, the FBI also manages a vertical coalition with thousands of state and local police departments. Through the Joint Terrorism Task Forces and the National Academy, the bureau tethers local agencies to its mission. It provides resources, training, and prestige. In exchange, these local agencies provide the bureau with a grassroots shield. When a populist movement attacks the FBI, the bureau points to its partnerships with “the men and women in blue” to borrow their local legitimacy.
The threat of the counter-narrative
Alliance Theory suggests that the greatest threat to a coalition hub is the emergence of a rival information node. If a political movement creates its own media ecosystem and its own team of former investigators, it can produce a credible counter-narrative. This breaks the bureau’s monopoly on “truth.” We see this in the rise of alternative investigative platforms and congressional subcommittees that perform their own depositions. When the bureau can no longer control the primary narrative, its value to its media and political allies drops.
Strategic ambiguity as a survival tool
The FBI thrives on a logic of strategic ambiguity. It must remain just vague enough to avoid being pinned down by any one political faction while remaining just specific enough to satisfy a judge. It uses the “pending investigation” or “classified methods” labels to freeze public inquiry. This allows the bureau to wait for the political winds to shift before it commits to a definitive stance. This logic ensures that the institution outlasts the transient political figures who attempt to steer it.
The stability of the administrative state
At the center of these alliances sits the preservation of the administrative state. The FBI acts as the enforcement arm for a specific vision of governance where professional bureaucrats, not elected officials, provide the continuity of the regime. This explains why the bureau reacts so sharply to movements that favor “disruption” or “deconstruction.” The bureau is a creature of the permanent government. Its symmetry with other agencies like the CIA or the NSA creates a unified front that resists any external attempt to reorder the hierarchy of power.
Leaks are not lapses in security. They are the primary mechanism the bureau uses to adjust the logic of its alliances in real time. Under Alliance Theory, a leak is a strategic transfer of “information capital” from the institution to a specific ally, usually to trigger a predictable response in the broader ecosystem.
The narrative-laundry cycle
The bureau uses leaks to bypass the rigid constraints of the legal system. If the FBI has information that is not yet admissible in court but is vital to its reputational standing, it leaks that information to a prestige media ally. The media outlet then publishes the narrative, which creates a public “fact” that the legal-managerial elite can then use as a basis for political or legal action. This creates a cycle where the bureau provides the raw material, the media provides the public legitimacy, and the courts or Congress provide the ultimate enforcement. Each party gets what it needs to maintain its own status.
Leaks as internal discipline
High-profile leaks also serve as a tool for internal coalition management. When a senior official leaks against a rival within the bureau or the Department of Justice, they are signaling to external allies that a specific faction is no longer “in alignment” with the institutional mission. This often precedes a forced resignation or a change in leadership. The leak acts as a trial balloon to see if the external alliance—the media and the legal elite—will support the removal of the targeted individual.
The “pending investigation” shield
The bureau uses the existence of a leak to justify withholding information from its more volatile allies, such as congressional oversight committees. By claiming that a leak has compromised an “ongoing investigation,” the FBI can refuse to provide documents or testimony to Congress while simultaneously continuing to feed information to its media allies. This allows the bureau to choose which oversight it accepts. It favors the soft oversight of a friendly press over the hard oversight of a hostile legislative body.
Defensive leaking against populism
When a populist movement threatens the bureau’s legitimacy, the frequency and intensity of leaks increase. These leaks are designed to remind the legal-managerial class of the dangers the populist movement poses to “institutional stability.” By framing the movement as a threat to national security, the bureau forces its allies in the judiciary and the media to close ranks. The leak is the signal that the “equilibrium” is under attack and that the coalition must mobilize to defend the status quo.
The price of a fractured alliance
If the bureau leaks to an outlet that is later seen as partisan or unreliable, the value of its information capital drops. This is the danger of the “Trump disruption.” When the FBI’s traditional media allies are successfully framed as partisan actors by a rival coalition, the bureau’s leaks no longer carry the weight of “institutional truth.” They are instead viewed as “propaganda.” This forces the bureau to find new allies or to retreat into a state of extreme technical secrecy to preserve what remains of its prestige.
The FBI and the CIA sit in the same national security ecosystem but they occupy different alliance positions. When you apply David Pinsof’s Alliance Theory, the key difference is which coalitions each institution depends on to survive.
The FBI’s alliances are domestic and legal. The CIA’s alliances are geopolitical and executive.
That structural difference explains most of the cultural and behavioral contrasts between the two organizations.
The FBI’s alliance structure
The FBI’s legitimacy comes from domestic institutions. Its work must survive scrutiny from courts, prosecutors, and Congress.
Its primary alliance partners include:
The Department of Justice
Federal judges and prosecutors
Congressional oversight committees
Domestic law enforcement networks
Prestige media outlets
Because of this alliance structure, the FBI signals procedural legitimacy. It talks constantly about evidence, warrants, and the rule of law.
Those signals are coalition maintenance. If the courts distrust the FBI, the bureau loses its operational power.
The CIA’s alliance structure
The CIA operates in a different coalition environment. Its survival depends less on courts and more on the executive branch and the national security elite.
Its primary alliances include:
The White House
The National Security Council
The Pentagon
Foreign intelligence services
Defense contractors and strategic think tanks
Because of this structure, the CIA signals strategic competence rather than procedural legitimacy.
It talks about intelligence assessments, threats, and geopolitical competition.
Courts almost never evaluate CIA operations. That changes the institution’s incentives dramatically.
Different audiences
Alliance Theory predicts that organizations adapt their behavior to the audiences that sustain them.
The FBI performs for a legal audience.
The CIA performs for a strategic audience.
An FBI investigation must eventually persuade a jury or a judge.
A CIA assessment must persuade policymakers and allies inside the national security community.
This difference shapes institutional culture.
The FBI tends to attract lawyers and investigators.
The CIA tends to attract analysts, foreign policy specialists, and covert operators.
Conflict and cooperation
Even though they belong to the same national security state, the FBI and CIA sometimes compete because their alliances overlap but are not identical.
The FBI dominates domestic intelligence and counterintelligence investigations.
The CIA dominates foreign intelligence and covert operations.
When a case crosses the border between domestic and foreign domains, jurisdictional friction appears.
For example:
Counterterrorism investigations
Foreign espionage cases
Cyber operations involving foreign actors
In these areas both agencies want influence because influence means resources and prestige.
Alliance Theory predicts this kind of bureaucratic rivalry.
Each institution tries to persuade political leaders that it is the indispensable actor in that domain.
Information as alliance currency
Both agencies trade information to maintain alliances, but they distribute it to different audiences.
The FBI’s information currency flows toward:
Federal prosecutors
Congressional committees
Domestic political leadership
The press
The CIA’s information currency flows toward:
The White House
Defense planners
Allied intelligence services
Strategic think tanks
These networks form two partially overlapping but distinct elite coalitions.
Why the CIA is less publicly contested
The FBI regularly becomes the center of political controversy. The CIA far less so.
Alliance Theory explains why.
The FBI operates inside domestic politics. Its actions affect elections, public corruption cases, and political figures.
The CIA operates mostly outside the domestic political arena. Its work is secret and oriented toward foreign rivals.
Because of that, political coalitions fight more intensely over the FBI.
The bureau’s investigations can directly shift domestic power.
The CIA’s influence is more indirect.
The national security elite as a shared alliance
Despite these differences, both institutions ultimately belong to the same broader coalition.
The American national security establishment.
This alliance includes:
The intelligence community
The Pentagon
Defense contractors
Strategic think tanks
Foreign policy elites in Washington
Within this ecosystem the FBI and CIA play complementary roles.
The CIA gathers foreign intelligence and conducts covert operations.
The FBI protects the domestic system from espionage, terrorism, and internal threats.
You can think of the CIA as the external intelligence arm of the coalition and the FBI as the internal security arm.
Both institutions ultimately protect the stability and power of the same governing alliance.
That is why, despite occasional rivalry, they usually close ranks when they perceive a threat to the broader national security establishment.
The failures before the September 11 attacks were not mainly about lack of intelligence. Both the FBI and CIA possessed fragments of information that, in hindsight, pointed toward the plot. The failure was structural. Their alliance structures, incentives, and information rules prevented those fragments from being combined in time.
Alliance Theory helps explain why.
CIA failures
The CIA’s job was foreign intelligence. Its alliance network was the executive branch and the international intelligence community. That shaped its priorities.
The most important CIA failure involved two future hijackers. Khalid al-Mihdhar and Nawaf al-Hazmi attended an al-Qaeda meeting in Kuala Lumpur in January 2000 that the CIA monitored. The agency learned that Mihdhar had a U.S. visa.
This was a huge signal. A known al-Qaeda associate had legal entry to the United States.
The CIA did not immediately notify the FBI that the two men had entered the country.
They also failed to place Mihdhar on the State Department watchlist until August 2001. By then the plot was already in its final stage.
Several structural problems were involved.
First, the CIA was oriented toward tracking networks overseas. Once suspects entered the United States, they moved into a domain the CIA did not control.
Second, the CIA treated intelligence as a scarce resource inside its alliance network. Information often stayed within the agency or circulated among a small group of analysts rather than being widely shared.
Third, the agency underestimated the possibility that al-Qaeda would conduct a large operation inside the United States itself.
So the key CIA failure was not recognizing the domestic significance of information it already possessed.
FBI failures
The FBI’s problem was the opposite. It had domestic jurisdiction but lacked a strategic intelligence mindset.
Before 9/11 the bureau operated mostly as a law enforcement organization. Agents focused on building prosecutable cases rather than detecting strategic threats.
Two incidents illustrate the problem.
In July 2001 an FBI agent in Phoenix, Arizona sent what became known as the “Phoenix memo.” The memo warned that suspicious Middle Eastern students were enrolling in U.S. flight schools and suggested investigating whether al-Qaeda was trying to train pilots.
The memo never triggered a national investigation.
At roughly the same time, FBI agents in Minneapolis arrested Zacarias Moussaoui, who was behaving suspiciously at a flight school. Local agents believed he might be connected to terrorism and tried to obtain a warrant to search his laptop.
FBI headquarters refused because the legal threshold for a surveillance warrant had not been met.
In other words, the bureau’s alliance with courts and prosecutors shaped its behavior. Agents were trained to think about evidence standards rather than catastrophic risk.
The legal mindset slowed action.
The information wall
Another major problem was the institutional barrier between intelligence and criminal investigations. This barrier became known as “the wall.”
The CIA operated under foreign intelligence authorities. The FBI operated under criminal investigative authorities. Sharing information across those boundaries was complicated and often discouraged.
Alliance Theory explains why.
Each institution protected its own jurisdiction because jurisdiction meant resources and prestige.
The CIA guarded intelligence sources.
The FBI guarded prosecutable cases.
The result was fragmented knowledge.
Pieces of the plot existed in different offices but were never assembled.
Failure of imagination
The 9/11 Commission later described a “failure of imagination.”
Many analysts knew that al-Qaeda wanted to attack the United States. They did not imagine the specific tactic of hijacking commercial airplanes and turning them into weapons.
In retrospect this seems obvious. At the time it conflicted with prevailing assumptions about terrorism.
Both agencies expected bombings similar to earlier attacks such as the 1998 U.S. embassy bombings in Kenya and Tanzania.
Alliance Theory would frame this as a shared coalition belief system. The intelligence community had a common narrative about how terrorism worked. That narrative filtered how new information was interpreted.
So even when clues appeared, they did not fit the dominant mental model.
The deeper structural problem
The deeper failure was that the American security system was split into two alliance worlds.
The CIA focused on foreign intelligence and covert operations.
The FBI focused on domestic law enforcement and prosecutions.
The 9/11 plot lived in the gap between those worlds.
The hijackers moved from foreign networks into the United States. Once inside, the intelligence fragments were scattered across agencies that did not naturally share information.
After the attacks the U.S. government reorganized the system to close that gap. The Department of Homeland Security was created. The Director of National Intelligence position was established. Information sharing rules were expanded.
Those reforms were attempts to realign the alliance structure so intelligence could move more easily between institutions.
The tragedy of 9/11 was that the clues existed. The coalition structure of the national security system prevented them from being connected in time.
The FBI and CIA are both still focused on national security, but their priorities today reflect the threats that dominate the current strategic environment. If you strip away the press releases, each agency is basically organized around a handful of threat categories.
FBI priorities today
The FBI’s mission is domestic security and federal crime. Its work spans national security and law enforcement.
The main operational priorities right now are:
Terrorism
Preventing terrorist attacks inside the United States remains the FBI’s top mission. The bureau works to identify and disrupt both international jihadist networks and domestic extremist plots before they turn violent.
The current concern is less about large organized cells and more about lone actors or small groups radicalized online who may act independently.
Foreign espionage and counterintelligence
A major FBI focus is identifying foreign intelligence operations inside the United States.
The biggest targets are usually:
Chinese intelligence networks
Russian intelligence operations
Iranian covert activities
North Korean espionage
These investigations often involve theft of technology, recruitment of insiders, or influence campaigns.
Cyber attacks
Cyber crime and cyber espionage have become one of the bureau’s fastest growing missions.
The FBI is investigating:
Ransomware groups
State-backed hacking teams
Intellectual property theft
Attacks on critical infrastructure
These operations often involve foreign governments or criminal networks operating overseas.
Transnational criminal networks
The bureau is heavily focused on global criminal organizations that operate across borders.
Examples include:
Drug cartels
Human trafficking networks
Money laundering organizations
Smuggling and weapons trafficking
New federal task forces created in recent years specifically target cross-border criminal networks and cartels.
Violent crime and gangs
Recent policy shifts have also pushed the FBI to devote more resources to violent crime, gang activity, and drug trafficking inside the United States.
This includes operations against groups like MS-13 and other transnational gangs.
Immigration enforcement and border crime
Under the current policy direction, FBI agents have been increasingly involved in immigration-related enforcement and investigations tied to smuggling networks and illegal entry.
CIA priorities today
The CIA operates in a different world. It does not prosecute criminals or run domestic investigations. Its job is to collect intelligence and conduct covert operations overseas.
Its current priorities broadly fall into five categories.
China
China is widely considered the CIA’s top strategic priority.
The agency focuses on:
Chinese military capabilities
Technology competition
Economic espionage
Influence operations around the world
A huge share of CIA analytical resources today is devoted to understanding Beijing’s long-term strategy.
Russia
Russia remains a central intelligence target because of:
The war in Ukraine
Cyber operations
Nuclear strategy
Political influence campaigns
Monitoring Russian military and intelligence activity is a major part of CIA work.
Iran
Iran is another key target because of:
Nuclear program monitoring
Regional proxy networks
Missile development
Intelligence operations in the Middle East
Iran’s regional influence and its relationship with Russia and China keep it high on the CIA agenda.
Terrorist networks abroad
Although the peak of the war on terror has passed, the CIA still tracks jihadist groups such as ISIS and al-Qaeda and monitors areas where they may regroup.
These networks are weaker than they were twenty years ago but still considered capable of attacks.
Technology and cyber competition
Intelligence agencies are increasingly focused on strategic technologies.
These include:
Artificial intelligence
Semiconductors
Quantum computing
Biotechnology
The concern is that technological breakthroughs can shift military and economic power between great powers.
The deeper pattern
If you look at both agencies together, the division of labor is clear.
The FBI hunts threats that touch the United States directly.
terrorists inside the country
foreign spies operating in the U.S.
cyber criminals targeting U.S. companies
organized crime networks
The CIA hunts threats that originate abroad.
foreign governments
military capabilities
covert influence operations
terrorist networks overseas
You could summarize it this way.
The CIA watches the world.
The FBI protects the homeland.
From an Alliance Theory perspective, the difference comes from their audiences.
The FBI answers to courts, prosecutors, and domestic politics.
The CIA answers to presidents, national security officials, and geopolitical strategy.
Those alliance networks shape what each agency spends its time chasing.
Every intelligence system misses things because it is built to see certain threats clearly and others poorly. The FBI and CIA are optimized for threats that look like their past successes. That leaves blind spots.
Three structural biases drive most of those blind spots.
First, both agencies are organized around known adversaries. China, Russia, Iran, jihadist groups, and transnational crime. If a threat does not look like those categories, it receives less attention.
Second, they focus heavily on actors and organizations. Networks, leaders, and conspiracies are easier to track than slow systemic risks.
Third, their incentives reward preventing the last disaster rather than anticipating a completely new one.
Several categories of threats fall into those gaps.
Technological shocks
Intelligence agencies track technology competition, but they are less equipped to predict disruptive breakthroughs that suddenly change power balances.
Examples include AI autonomy, synthetic biology, and cheap drone warfare.
These are not traditional intelligence targets. They emerge from universities, startups, and open research communities. The most consequential breakthroughs may occur outside government visibility.
The risk is that strategic capabilities could emerge faster than institutions can understand them.
Private power
The global system now contains actors with resources comparable to small states.
Major technology firms, private satellite networks, crypto infrastructure, and global financial platforms all have strategic influence.
Intelligence agencies historically focus on governments and terrorist groups. The rise of powerful private actors creates new geopolitical dynamics that intelligence frameworks are still adapting to.
A private network controlling communications, logistics, or digital infrastructure can shape conflicts as much as a state.
Systemic fragility
Both agencies are good at detecting intentional threats.
They are weaker at analyzing systemic vulnerabilities.
Financial shocks, infrastructure collapse, supply chain breakdowns, and cascading cyber failures often arise from complex systems rather than deliberate attacks.
Those risks do not have a clear adversary, so they receive less intelligence focus even though their impact could rival traditional security threats.
Elite belief failures
Intelligence communities depend heavily on shared assumptions about how the world works.
When those assumptions are wrong, institutions can miss major developments even while collecting good data.
Before the Soviet collapse, most intelligence services did not predict the speed of the system’s breakdown. Before the Arab Spring, intelligence assessments underestimated how quickly regimes could destabilize.
The blind spot was not lack of information. It was misreading elite cohesion and political legitimacy inside those societies.
Something similar could occur today in countries where political systems appear stable but contain hidden fractures.
Domestic institutional risk
The FBI especially tends to frame threats in terms of criminal networks or extremist groups.
But political instability sometimes arises from institutional breakdown rather than organized conspiracies.
Erosion of public trust in institutions, polarization inside security services, or legitimacy crises can create instability that intelligence agencies are poorly structured to analyze.
They are designed to identify bad actors, not to diagnose systemic legitimacy problems.
Strategic deception by major powers
The CIA is heavily focused on China and Russia. That does not eliminate the risk of misreading their strategy.
Major powers sometimes pursue long-term strategies that are deliberately ambiguous. Military buildups may mask defensive intentions or offensive ambitions. Economic policies may have hidden geopolitical goals.
The danger is not missing the existence of those states. It is misinterpreting their long-term strategic trajectory.
Low probability high impact events
Intelligence systems struggle with “black swan” scenarios.
Pandemics are a good example. Intelligence agencies warned about the possibility for years, but the scale and speed of COVID-19 still shocked governments.
Future examples could include engineered pathogens, sudden technological breakthroughs, or unexpected military innovations.
These events are difficult to prioritize because they appear speculative until they happen.
Institutions pay more attention to threats that reinforce their existing missions.
If an agency gains funding and prestige by fighting terrorism, terrorism becomes a central organizing threat.
Threats that do not align with institutional identity receive less attention.
The FBI sees criminals and spies.
The CIA sees rival states and foreign networks.
But many future disruptions may not look like either of those categories.
The hardest threats to see are the ones that do not resemble anything the system was designed to detect.
Military power historically came from state-controlled defense industries.
Today some of the most important technologies are developed in commercial sectors. Satellites, drones, AI software, and cyber tools are widely available.
In conflicts like Ukraine, relatively inexpensive drones and commercial satellite imagery dramatically changed battlefield dynamics.
Traditional intelligence frameworks often assume that military advantage comes from classified programs and national arsenals. Cheap commercial technology can disrupt that assumption.
Pandemics as strategic events
For decades intelligence reports warned about the risk of pandemics. But pandemics were usually treated as public health issues rather than geopolitical shocks.
COVID-19 demonstrated that a virus can destabilize economies, reshape global supply chains, and alter political systems.
The disruption came not from a hostile actor but from biological evolution interacting with global connectivity.
The intelligence system was not structured to treat that kind of event as a central national security threat.
Energy transitions
For much of the twentieth century, intelligence agencies focused heavily on oil geopolitics.
The long-term transition toward renewable energy and electrification may change strategic power in ways that are difficult to predict.
Countries that dominate critical minerals, battery technologies, or electrical infrastructure could gain influence that rivals traditional oil producers.
These shifts unfold slowly and involve industrial ecosystems rather than military moves. They are harder for traditional intelligence frameworks to track.
Institutional decay inside democracies
Intelligence agencies are comfortable studying the stability of foreign governments.
They are less comfortable analyzing institutional fragility inside their own societies.
Polarization, declining trust in institutions, and political legitimacy crises can create security risks that do not involve espionage or terrorism.
Because intelligence agencies operate within those same institutions, recognizing those threats can be politically sensitive and analytically difficult.
The underlying pattern
When a system is designed to hunt a particular type of adversary, it develops tools, incentives, and mental models tailored to that adversary.
During the Cold War the system hunted superpowers.
After 9/11 it hunted terrorist networks.
Today it hunts rival states and cyber actors.
But the next disruptive event may not come from any of those categories.
It may come from technological change, systemic fragility, or social dynamics that do not resemble traditional security threats.
Those are the dangers most likely to arrive before institutions realize they are threats.
If you rank threats by two variables, motivation to harm the United States and capability to actually do serious damage, the list is fairly clear. A lot of actors hate the United States but lack the ability to do much. Others have enormous capability but limited incentive to use it directly. The most dangerous actors are the ones that combine both.
China
China sits at the top because it has the largest combination of capability and long term strategic rivalry with the United States.
China has the economic scale, technological base, intelligence apparatus, cyber capabilities, and military power to inflict serious damage across multiple domains. That includes cyber sabotage, economic coercion, influence operations, and conventional military conflict.
Beijing’s goal is not necessarily to destroy the United States but to displace it as the dominant global power. That means weakening American alliances, undermining technological leadership, and reducing U.S. influence in Asia and global institutions.
Because China operates as a patient strategic competitor rather than a reckless aggressor, the risk is long term erosion rather than sudden attack.
Russia
Russia has fewer resources than China but stronger incentives to harm American power directly.
The Russian system is built around geopolitical confrontation with the West. Moscow has repeatedly used cyber operations, political interference, intelligence operations, and energy leverage against Western states.
Russia’s capability lies especially in asymmetric warfare. Cyber attacks, disinformation campaigns, covert operations, and nuclear deterrence.
It cannot defeat the United States conventionally but it can impose costs and destabilize political systems.
Iran
Iran is a regional power with a strong ideological incentive to oppose the United States and Israel.
Its capabilities include missile forces, proxy militias across the Middle East, cyber operations, and intelligence networks.
Iran cannot seriously threaten the U.S. homeland militarily but it can attack American forces and interests abroad, disrupt energy markets, and use proxy groups to conduct attacks.
North Korea
North Korea has one overriding strategic asset. Nuclear weapons combined with increasingly capable ballistic missiles.
The regime is highly hostile to the United States and uses confrontation as part of its survival strategy.
However its broader capabilities are limited. The economy is weak and the military is technologically outdated except in nuclear and missile programs.
The danger comes from the possibility of escalation or miscalculation.
Transnational cyber criminal networks
Large cyber crime organizations are increasingly capable of harming the U.S. economy.
These groups run ransomware operations, steal financial assets, attack hospitals and infrastructure, and sometimes cooperate with hostile states.
Their motivation is profit rather than ideology, but the damage they can inflict is real.
Because they often operate from countries that do not prosecute them, they have a degree of impunity.
Jihadist terrorist networks
Groups such as ISIS or al Qaeda still have ideological motivation to attack the United States.
However their capability is much lower than it was twenty years ago. Their leadership structures have been heavily disrupted and their operational reach is limited.
The remaining risk comes mainly from lone actors or small cells inspired by their ideology rather than centrally planned large attacks.
Cartels and transnational criminal organizations
Drug cartels and trafficking networks affect American security indirectly through narcotics distribution, violence, and corruption.
They have enormous financial resources and sophisticated logistics networks.
However they generally avoid direct confrontation with the U.S. state because their business model depends on operating quietly inside American markets.
Their threat is social and economic rather than geopolitical.
Emerging technology actors
A newer category of risk involves actors who control powerful technologies rather than territory.
This could include advanced cyber groups, rogue AI developers, or organizations capable of manipulating biotechnology.
The motivation varies widely but the capability could become significant if disruptive technologies become easier to weaponize.
The deeper pattern
States still dominate the top of the threat hierarchy because they control the largest resources and military capabilities.
China and Russia have the ability to damage American power on a systemic scale.
Iran and North Korea can cause regional crises and limited military conflict.
Non state actors tend to operate in narrower domains like terrorism, cyber crime, or organized crime.
The most dangerous future threats may come from combinations of these actors.
For example a state that quietly supports cyber criminals, or a terrorist network that gains access to advanced technologies.
Those hybrid threats are the ones security agencies increasingly worry about because they blur the line between state and non state conflict.
A “Lee Harvey Oswald type” is usually a lone actor with political grievances who decides to commit violence against a symbolic target. The defining features are isolation, personal instability, and the absence of a large operational network.
These individuals are difficult for law enforcement because they operate outside organized groups. There is often no conspiracy to penetrate and no communication network to intercept.
Typical characteristics
Many lone political attackers share several traits.
Personal grievance and alienation. They feel marginalized or humiliated and search for a cause that explains their situation.
Identity seeking. Ideology becomes a way to give their life meaning. The ideology can vary widely. Marxism, white nationalism, jihadism, or conspiracy movements.
Attention seeking. Many attackers want recognition or historical significance. They imagine themselves as decisive actors who will change history.
Operational simplicity. They usually rely on relatively simple weapons and tactics rather than complex plots.
Information leakage. Before attacks they often reveal pieces of their thinking to acquaintances, online forums, or written material.
Oswald himself fit several of these patterns. He was socially isolated, politically radicalized, and obsessed with recognition.
Why they are hard to detect
Law enforcement is designed to investigate organizations. Lone actors operate differently.
They may not communicate with co conspirators.
Their preparation often looks like ordinary activity. Buying a rifle, traveling to a location, or writing online posts.
Their radicalization process may occur entirely inside their own head with only small outward signals.
Because of this, predicting which alienated person will turn violent is extremely difficult.
What law enforcement can realistically do
There is no perfect prevention strategy, but several approaches can reduce risk.
Information sharing
One of the biggest improvements since the early 2000s is intelligence sharing between federal, state, and local agencies.
Fusion centers and joint terrorism task forces allow scattered pieces of information to be combined. If a person appears in multiple reports or investigations, the pattern becomes visible.
Threat assessment units
Many law enforcement agencies now operate behavioral threat assessment teams.
These teams analyze individuals who display warning signs such as violent threats, stalking of public officials, or obsessive interest in attacks.
The focus is not simply arrest but intervention before violence occurs.
Monitoring public threats
Many attackers leak their intentions in some way. They post manifestos, send threatening messages, or tell acquaintances about violent plans.
Encouraging reporting from the public and monitoring open online spaces helps identify individuals moving toward violence.
Protective intelligence
For high value targets such as presidents, judges, or major political figures, specialized units analyze threats constantly.
The Secret Service pioneered this model. Analysts study patterns of behavior that often precede attacks and intervene when someone shows escalation.
Reducing access to vulnerable targets
Physical security measures reduce opportunities for lone attackers.
Examples include controlled access to buildings, screening at public events, and protective details for officials.
These measures cannot eliminate risk but they raise the difficulty of carrying out an attack.
Mental health intervention
Many lone attackers show signs of psychological distress before violence.
When law enforcement partners with mental health services, individuals can sometimes be diverted into treatment rather than drifting toward violence.
This approach is controversial but increasingly common in threat management programs.
The limits of prevention
Even with all these measures, lone attackers remain one of the hardest threats to stop.
They require minimal coordination and often act quickly once they decide to attack.
Most alienated people never become violent, which makes it difficult to distinguish the truly dangerous individuals from the much larger population of troubled but non violent people.
In practice the goal is risk reduction rather than perfect prevention.
By combining intelligence sharing, behavioral analysis, public reporting, and protective security, law enforcement can reduce the number of opportunities for a lone actor to carry out an attack.
Thomas Matthew Crooks, the man who attempted to assassinate Donald Trump in July 2024, fits the modern lone-actor pattern that security services struggle with. These attackers usually do not belong to a clear group, so they only become visible if small signals accumulate.
The practical question for law enforcement is not “predict the attacker.” That is almost impossible. The realistic goal is noticing clusters of warning signs early enough to intervene.
Pre-attack signals that sometimes appear
Many lone attackers leak pieces of intent before violence. Not all of them do, but when they do, the signals usually fall into several categories.
Threatening or obsessive online behavior.
Individuals may post violent fantasies, admiration of past attackers, or discussions about assassination or mass violence.
Fixation on a specific target.
Threat assessment experts call this “pathway behavior.” The person becomes obsessed with a public figure, event, or location.
Weapons acquisition combined with grievance narratives.
Buying weapons is legal in most cases, but when it occurs alongside escalating political rage or violent rhetoric it becomes a stronger signal.
Reconnaissance behavior.
Visiting event locations, studying security layouts, or repeatedly approaching protected individuals.
Sudden behavioral shifts.
Friends or family sometimes notice isolation, emotional collapse, or apocalyptic thinking before attacks.
Most of these signals are ambiguous individually. They only become meaningful when multiple signs appear together.
How law enforcement sometimes detects these patterns
Reporting networks
Many cases start with tips from people who know the individual. Family members, teachers, coworkers, or online users sometimes report disturbing statements.
Public tip lines and school reporting systems exist precisely for this reason.
Open source monitoring
Investigators monitor public online spaces where threats sometimes appear. They do not need private access if someone posts violent intentions openly.
The goal is identifying individuals who escalate from ideological talk to operational planning.
Threat assessment teams
Federal and local agencies now run behavioral threat assessment units.
These teams evaluate people who show concerning behavior. Instead of waiting for a crime, they try to intervene earlier through investigation, warnings, or referrals.
Protective intelligence
For high profile figures such as presidents or presidential candidates, the United States Secret Service maintains databases of people who have made threats or displayed fixation.
Analysts look for individuals who show signs of moving from talk to action.
Information fusion
One lesson from September 11 attacks was that small clues scattered across agencies can reveal patterns when combined.
Joint terrorism task forces allow local police, the Federal Bureau of Investigation, and other agencies to share information about suspicious individuals.
Why many attackers still slip through
Even with these systems, many lone attackers remain invisible.
Most do not make explicit threats.
Most legal behaviors such as buying a rifle or attending a public event are not suspicious on their own.
Many attackers decide to act quickly once the idea crystallizes.
The base rate problem is severe. Millions of people express anger or extreme opinions online. Only a tiny fraction become violent.
That makes it difficult to distinguish genuine threats without over-policing ordinary behavior.
What most increases the chance of detection
The strongest predictors usually involve combinations of behavior.
Explicit threats combined with weapon acquisition.
Fixation on a target combined with reconnaissance.
Personal crisis combined with violent ideological thinking.
When those patterns appear together, threat assessment teams often move quickly.
The core reality is that lone attackers like Crooks are not usually stopped by intelligence breakthroughs. They are most often stopped by ordinary people reporting concerning behavior before the attack occurs.
Vertical alliances → Ties to local police for grassroots legitimacy (“men and women in blue”).
Strategic ambiguity → “Pending investigation” or classified labels as tools to wait out political shifts.
Leaks as discipline → Internal signaling to external allies about misaligned factions.
FBI vs. CIA comparison → FBI’s domestic-legal alliances make it publicly contested; CIA’s executive-geopolitical ones keep it enigmatic and less vulnerable to populism.
9/11 structural failures → Alliance silos (CIA foreign vs. FBI domestic) prevented info-sharing; reforms tried to realign coalitions.
Current priorities → FBI: domestic terrorism, espionage (China/Russia), cyber, cartels. CIA: China/Russia/Iran, foreign terror, tech competition.
Blind spots → Over-focus on state/known actors; under-preparation for tech shocks, private power (e.g., Big Tech), systemic fragility, or black swans.
Threat rankings → China tops (capability + rivalry); Russia/Iran/NK follow; non-state actors lower unless hybridized.
Lone-actor threats → Hard to detect due to no network; prevention via tips, threat assessment, fusion centers (e.g., Crooks case).
Audience-capture → FBI trapped in domestic partisan gravity; CIA shielded.
NSLs → Administrative tool to turn tech/finance into proxy resources, bypassing courts while enforcing silence via gag orders.
The comparison between the FBI and CIA through Alliance Theory reveals why one is a constant lightning rod for domestic rancor while the other remains a high-status enigma. The difference is not just about geography; it is about the symmetry of their respective audiences.
The Audience-Capture Trap
The FBI’s survival depends on a “horizontal” alliance with the domestic legal-managerial elite—judges, the DOJ, and the Bar. Because these allies are themselves participants in domestic political life, the FBI is forced into the center of partisan gravity. If the FBI investigates a political figure, it is either “upholding the rule of law” (validating its elite alliance) or “engaging in a witch hunt” (threatening a rival mass-political alliance). There is no neutral ground because its “judges” are also the “players.”
The CIA, by contrast, manages a “vertical” alliance with the Executive and the global intelligence community. Since its work is largely shielded from domestic courts and public juries, it does not have to perform “procedural virtue” for the American public. It only needs to maintain its status as an indispensable provider of “strategic foresight” to the President. This makes the CIA much harder for populist movements to de-legitimize, as the agency’s “failures” are often classified, while its “successes” are credited to the administration.
Information as a Hostage
In the relationship between these two hubs, information acts as a tool for coalitional leverage. During the lead-up to September 11, the logic of institutional logic dictated that the CIA keep its “assets” (like the hijackers’ visa status) close to the vest to maintain its monopoly on foreign intelligence. Sharing that data with the FBI would have effectively “transferred” prestige from the CIA’s foreign-aligned coalition to the FBI’s domestic-legal coalition. The failure to connect the dots was not a lack of effort; it was the result of two different alliance managers protecting their respective “market shares” of state secrets.
The Rise of the “Open-Source” Rival
The most significant threat to the FBI’s alliance with prestige media is the democratization of investigative tools. When a blogger or a decentralized network of researchers can use public flight data, blockchain ledgers, or leaked documents to build a counter-narrative, the FBI’s “curated narrative” loses its value as a coalition currency. If the public no longer believes that only the FBI has the “expertise” to interpret a set of facts, the bureau’s technical-bureaucratic firewall begins to crumble.
The Permanence of the Managerial State
Ultimately, both agencies function to ensure that the logic of the administrative state outlasts any single political movement. They protect the logic of professional governance. When a populist movement targets “the Deep State,” it is essentially attacking the alliance between these agencies and the professional class. The agencies respond not as partisans, but as managers defending the “regime of expertise” that gives them their status.
National Security Letters (NSLs) function as the primary administrative tool for the FBI to secure its alliance with the technological and financial sectors. While the bureau frames these as routine investigative tools, they serve a specific coalitional purpose: they create a streamlined, non-judicial channel for transferring user data from private corporations to the state.
The bypassing of judicial oversight
The defining feature of an NSL is that it does not require a warrant or a judge’s signature. Instead, a senior FBI official, such as a Special Agent in Charge, certifies that the requested records are relevant to an authorized national security investigation. This allows the bureau to bypass the “hard” oversight of the court system. By removing the judge from the process, the FBI reduces the “transaction cost” of obtaining information. It replaces a legal confrontation with an administrative request, making compliance the path of least resistance for the recipient.
The gag order as coalition discipline
Almost every NSL includes a nondisclosure requirement, commonly known as a gag order. This order prohibits the recipient—whether it is an ISP, a bank, or a tech giant—from revealing that the FBI even made the request. In the logic of Alliance Theory, the gag order ensures the “purity” of the bureau’s information capital. If a tech company could publicly announce every data request, the subject of the investigation would be alerted, and the value of the information would vanish. The gag order forces the private sector ally into a state of enforced silence, tethering their reputation to the bureau’s secrecy.
Tech companies as proxy resources
Through NSLs, the federal government turns private businesses into “proxy resources” for state surveillance. Companies like Google, Microsoft, and various ISPs possess vast amounts of “non-content” data—subscriber names, IP addresses, billing records, and login histories. Because the Supreme Court has held that individuals have no “reasonable expectation of privacy” for information they voluntarily provide to third parties, the FBI can claim that no Fourth Amendment violation occurs. This legal symmetry allows the bureau to treat a tech company’s database as an extension of its own filing cabinet.
The cost of defiance
Defying an NSL is structurally difficult and financially “ruinous” for many firms. While the USA FREEDOM Act now allows recipients to challenge these orders in court, the burden remains on the company to initiate the process. For a large corporation, the legal fees required to litigate thousands of individual NSLs far outweigh the benefits of public defiance. Furthermore, many of these companies have extensive regulatory business before the government. Annoying the authorities by challenging a national security request could jeopardize other commercial interests. This creates a strong incentive for “unwitting” or “quiet” cooperation, cementing the alliance through economic necessity.
The fracture of “warrant-proof” encryption
The tension in this alliance appears when tech companies move toward end-to-end encryption. When a company can no longer provide “readable content” or transactional data, the bureau’s primary tool for coalition management fails. The FBI responds by framing “lawful access” not as a violation of privacy, but as a requirement for “public safety.” This is a reputational signal intended to pressure tech firms back into the institutional fold. The bureau argues that “lawless digital spaces” threaten the very stability that the legal-managerial class depends on.
The market for curated narratives
Ultimately, NSLs allow the FBI to maintain its monopoly on the domestic “intelligence market.” By collecting thousands of pieces of transactional data in secret, the bureau can build a curated narrative of a threat before it ever reaches a courtroom. This allows the bureau to present a “finished product” to its allies in the Department of Justice or the media, ensuring that the initial public perception of a case is shaped entirely by the bureau’s own information capital.
