How to Prevent Classified U.S. Intelligence from Ending up on Social Media

Once again, highly classified U.S. intelligence reports are circulating on social media. Last month, Telegram’s pro-Iran propaganda channel Middle East Spectator published two classified U.S. intelligence reports on tactical Israeli Air Force preparations for a retaliatory strike against Iran. While the leak of information meant only for Five Eyes allies is significant itself, it also sheds light on Iran’s global propaganda and influence operations on Telegram. Monitoring Iranian actors and activity on the platform is critical to mitigating precisely this sort of data leak and to enhancing U.S. messaging to Tehran’s audiences.

Middle East Spectator is an Iran-based, pro-regime channel with over 179,000 subscribers, and claims to be an objective news aggregator. But it is clearly more than that. The channel maintains that the leaked documents came from a U.S. Department of Defense official. The channel further asserts that an anonymous account directly messaged the documents to Middle East Spectator after a private Telegram group with over 7,000 members first circulated the leaked material. On November 13, The New York Times reported that the FBI arrested Asif W. Rahman, an employee of the CIA, in Cambodia under suspicion of leaking the material.

While the episode constitutes the first time a pro-Iran channel has posted classified U.S. documents, Telegram has long played a key role in Iranian online operations. Pro-Iranian actors, including those overtly affiliated with Iran and its proxies, utilize a network of English-language Telegram channels to promote Tehran’s narrative, disinformation, and propaganda about Israel and the United States. Such content often reaches hundreds of thousands or even millions of viewers with a single post. These channels frequently interact with each other as well, forwarding and boosting each other’s content to reach even larger audiences, often well outside their original community.

While the channels usually do not target Americans due to Telegram’s lack of popularity in the United States, they are an ideal platform for reaching global audiences susceptible to Iranian messaging. Telegram has also been central to ongoing propaganda efforts by Hamas and Hezbollah to target both Israelis and Arab populations in the Middle East. In another case, Iran-affiliated militias in Iraq utilized Telegram propaganda channels and discussion groups to promote anti-American messaging to Iraqi youth.

However, Telegram is difficult to monitor thanks to its limited native search and analytics capabilities. Telegram’s dedication to an absolutist approach on free speech, as per Telegram’s founder Pavel Durov, also makes the platform’s content difficult to moderate. Still, the Israel-Hamas War over the past year war has forced even Telegram to begin curbing some content at the request of Western governments.

Greater investment by U.S. intelligence agencies in infiltrating and monitoring groups and communities on Telegram would help the intelligence community more quickly identify potential leaks and other threats to national security. Leaked documents can circulate in closed groups, be they on Telegram or other platforms such as Discord, for weeks and even months prior to detection. Had the intelligence community spotted the documents in the private channel before Middle East Spectator posted them publicly, Washington might have mitigated the scale of the leak. U.S. infiltration of such groups, including those related to terrorism and organized crime, is also critical for countering other cyber threats.

Passive collection can only go so far, though. Active involvement and infiltration, be it physical or virtual, is often a requirement to acquire what is truly needed to make a decision. Virtual infiltration also has its own advantages: It is highly targeted and can be done in a way that minimizes potential violation of privacy rights. In addition, it is cost-effective and can bypass the encryption that makes signals intelligence collection so expensive and difficult to do at scale.

At the same time, given Telegram’s reach, Washington should regard the platform and others like it as key assets for promoting Western messaging globally. The American government currently focuses primarily on Western-oriented platforms, such as Facebook and X. Instead, the United States needs to respond directly to adversarial messaging on the same platform it originates. And Washington needs to conduct its own influence operations — aligned with democratic values — on the platforms that global audiences frequent. The unique features that make Telegram and other messaging applications so valuable and attractive to America’s adversaries can and should be utilized by the United States to promote its own interests abroad.

About the Author:

Ari Ben Am is an adjunct fellow at the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies. His research focuses on emerging threats, influence and information operations, cyber operations, and hybrid warfare. He is also the co-founder of Telemetry Data Labs, a Telegram data analytics and investigation platform. Follow Ari on X @ari_ben_am. The views expressed are the author’s own.