The Paradox of Proximity

Abstract

This article examines the fundamental paradigm shift in counterintelligence (CI) methodologies over the past half-decade and traces its direct implications for the close protection (CP) profession. Drawing on the theoretical framework of intelligence as a contest rather than a secret-keeping exercise, the analysis demonstrates how the digital transformation—specifically the maturation of artificial intelligence, the weaponization of open-source intelligence (OSINT), and the emergence of the "gray zone" conflict space—has rendered traditional, human-centric CI models increasingly obsolete. The article argues that the same technological vectors transforming state-level counterintelligence have created an unprecedented threat environment for protective principals, characterized by the atomization of lone-actor threats, digitally accelerated radicalization pathways, and the dissolution of physical perimeters as meaningful security boundaries. Through examination of multiple case studies from 2024–2026, including the assassination of Charlie Kirk and the murder of Brian Thompson, this analysis identifies the emergence of a new close protection paradigm defined by predictive intelligence integration, digital footprint management, and what the author terms "asymmetrical perimeter theory." The article concludes that close protection has effectively become the tactical edge of modern counterintelligence, requiring practitioners to abandon reactive playbooks in favor of intelligence-driven, preemptive operational models.

#CloseProtection #ExecutiveProtection #Counterintelligence #OSINT #LoneActorThreat#GrayZoneConflict #ProtectiveIntelligence #CharlieKirk #BrianThompson#ThreatAssessment #SecurityManagement #IntelligenceLed #PhysicalSecurity#DigitalFootprint #AsymmetricThreats

1. Introduction

For much of the twentieth century, counterintelligence and close protection existed as parallel but largely distinct professional domains. Counterintelligence—the practice of preventing and neutralizing foreign intelligence entities' efforts to collect information or subvert national security—operated in the shadowy realm of double agents, defectors, and coded communications. Close protection, conversely, concerned itself with the physical security of individuals against direct, kinetic threats: the assailant with a handgun at a rally, the car bomb on a motorcade route, the knife-wielding attacker in a lobby. The two disciplines intersected primarily in the protection of senior intelligence officials and heads of state, but their methodologies remained largely separate.

The past five years have witnessed the violent collapse of this separation.

The convergence of three distinct technological and geopolitical developments has fundamentally redrawn the threat landscape. First, the proliferation of artificial intelligence has automated and scaled espionage activities, enabling what scholars term "cyber-native" rather than merely "cyber-enabled" operations. Second, the emergence of the "gray zone"—the ambiguous space between peace and war where state and non-state actors operate without triggering traditional military responses—has normalized persistent, low-level hostile intelligence activities as a continuous feature of international competition. Third, and most critically for close protection, the democratization of OSINT and the radicalizing potential of algorithmic content delivery have transformed the lone actor from a peripheral anomaly into the dominant threat vector for protected principals.

This article advances three interconnected arguments. First, that the transformation of counterintelligence from a defensive, reactive discipline to a predictive, technology-enabled enterprise has produced methodological innovations that are directly transferable to close protection. Second, that the contemporary threat environment facing protective principals is fundamentally an intelligence problem rather than a purely physical security problem. Third, that the close protection profession has entered a period of "paradigm rupture," wherein legacy operational models—reliant on physical perimeters, reactive counter-surveillance, and post-incident analysis—are no longer adequate to anticipated threats.

The analysis proceeds in four parts. Section two traces the theoretical evolution of counterintelligence in the digital age, drawing on recent scholarship to establish the conceptual framework of intelligence as an open-ended "contest" rather than a closed system of secrets. Section three examines the empirical transformation of the threat environment, using case study analysis of major security incidents from 2024–2026 to identify emergent patterns in attacker methodology. Section four synthesizes these findings to articulate the new close protection paradigm, introducing the concept of "asymmetrical perimeter theory" and specifying operational requirements for intelligence-led protective programs. The conclusion addresses the implications for professional standards, training, and the future trajectory of the field.

2. The Theoretical Transformation of Counterintelligence in the Digital Age

2.1 The Traditional Paradigm: Counterintelligence as Secret-Keeping

Traditional counterintelligence theory has been dominated by what might be termed the "containment model." This model conceptualizes intelligence as a finite set of secrets—classified documents, technical specifications, operational plans—that must be protected through access controls, personnel vetting, and counter-espionage operations. The adversary is understood as a foreign intelligence entity (FIE) operating through identifiable channels: diplomatic cover, recruited assets, technical interception. The counterintelligence mission is therefore one of denial and detection: deny access to protected information and detect those who attempt unauthorized access.

This model, while never fully adequate to the complexity of intelligence work, provided a coherent operational framework for much of the Cold War period. Human intelligence (HUMINT) and signals intelligence (SIGINT) constituted the primary collection disciplines, with counterintelligence efforts focused on identifying and neutralizing hostile spies within government and military institutions. The close protection corollary was straightforward: physical access to the principal constituted the primary vulnerability, and security measures concentrated on controlling that access through layered perimeters, advance reconnaissance, and real-time surveillance detection.

Several implicit assumptions undergirded this traditional framework. First, that intelligence collection and hostile action required meaningful resource investment, creating a barrier to entry that excluded all but state actors and well-funded organizations. Second, that the distinction between intelligence collection and operational action (sabotage, assassination, subversion) remained relatively clear, with different legal and policy frameworks applying to each. Third, that time horizons for threat development were extended, allowing for pattern recognition, source recruitment, and progressive warning. Fourth, that the physical domain remained primary; the digital realm was understood as a supporting environment rather than an autonomous battlespace.

Each of these assumptions has been systematically undermined over the past decade, and the pace of erosion has accelerated dramatically since 2020.

2.2 The Gray Zone Revolution

The concept of the "gray zone" has emerged as a crucial analytic framework for understanding contemporary conflict, particularly in the context of cyber operations and intelligence activities. Gray zone operations are characterized by their ambiguous relationship to traditional thresholds of armed conflict: they fall below the level of overt hostilities but exceed the bounds of routine state-to-state competition. They are persistent rather than episodic, deniable rather than attributable, and cumulative in effect rather than discrete in outcome.

For counterintelligence, the gray zone presents a fundamental challenge to traditional mission boundaries. As one analyst notes, "The dissolution of a clear distinction between peacetime competition and active conflict has resulted in a continuous state of confrontation" . In this environment, intelligence agencies conduct operations that are not classic espionage—the passive collection of information—but rather active interference in the affairs of other states: sabotage, subversion, information operations, and influence campaigns. The 2016 Russian election interference, the NotPetya attack, and the SolarWinds compromise exemplify this new operational reality: all were conducted by intelligence agencies, all involved active manipulation rather than passive collection, and all operated in the legal and normative gray zone where traditional prohibitions on hostile action remain unclear.

The implications for close protection are significant but non-obvious. The gray zone framework suggests that protective principals are not merely targets of occasional assassination attempts but rather persistent nodes in an ongoing, multi-domain contest. Their movements, associations, communications, and vulnerabilities are continuously mapped by adversary intelligence collection. More critically, the gray zone environment normalizes the prepositioning of access and capability that can be rapidly converted from surveillance to action when opportunity or directive dictates.

This represents a qualitative shift from the traditional threat model. Historically, the assassination of a protected principal required a discrete operational decision followed by a period of preparation: target surveillance, access development, capability acquisition, and execution. Each stage created opportunities for detection and interdiction. In the gray zone environment, however, adversary intelligence entities may maintain persistent access to the principal's digital and physical environment as a routine matter of competitive posture. The decision to act may be followed by execution windows measured in hours or days rather than weeks or months, dramatically compressing the warning timeline.

2.3 The AI Multiplier: From Cyber-Enabled to Cyber-Native Operations

A crucial analytic distinction has emerged in recent scholarship between "cyber-enabled" and "cyber-native" operations. Cyber-enabled operations represent traditional espionage or attack methodologies executed through digital means: a human spy is replaced by a computer-based access method, but the fundamental logic of the operation remains unchanged. Cyber-native operations, conversely, are designed, developed, and executed using cyber capabilities throughout the operational lifecycle. They are not traditional operations translated into digital form but rather new operational forms that are only possible because of digital technology.

This distinction has profound implications for counterintelligence and, by extension, for close protection. The integration of artificial intelligence into intelligence operations—both offensive and defensive—represents the transition from cyber-enabled to cyber-native paradigms at scale. AI capabilities enable three categories of operation that were previously impossible or impractical:

Automated Espionage and Big Data Analysis: AI-powered tools can process, translate, and analyze heterogeneous datasets at scales far exceeding human capacity. This capability transforms OSINT from a supplementary collection discipline into a primary intelligence source capable of generating actionable targeting information from publicly available data. For close protection, this means that the principal's digital footprint—social media activity, business associations, travel patterns, family connections—can be continuously harvested and analyzed by adversary entities without significant resource investment.

Adaptive and Autonomous Cyber Operations: Machine learning algorithms enable cyber operations that adapt to defensive measures in real time, creating persistent access that traditional signature-based detection cannot identify. The concept of the "low and slow" penetration—previously requiring skilled human operators—can now be automated across thousands of targets simultaneously. For protected principals, this translates to continuous compromise of personal and professional communications, location data, and scheduling information.

Synthetic Content and Influence Operations: Generative AI can produce convincing synthetic media—deepfakes, fabricated communications, artificial social media personas—at scale. These capabilities enable sophisticated social engineering attacks against protective teams and their principals, as well as the rapid radicalization of potential lone actors through algorithmically amplified grievance content.

The defensive application of AI to counterintelligence is developing in parallel but faces significant asymmetries. As one observer notes, "The failure of the United States to strategically integrate AI into CI methodologies will result in the systemic erosion of national technological and economic advantage". The same principle applies to close protection: protective programs that do not integrate AI-driven threat intelligence, anomaly detection, and predictive analysis will find themselves systematically outmatched by adversaries who do.

2.4 The Collapse of the Attribution Barrier

Traditional counterintelligence placed significant emphasis on attribution—the ability to identify the actor behind a hostile operation with sufficient confidence to inform response decisions. Attribution enabled deterrence, retaliation, and diplomatic action. It also provided a framework for understanding adversary intent and anticipating future operations.

The digital environment has systematically eroded the attribution function. The combination of anonymizing technologies, false-flag operations, and the inherent ambiguity of cyber means has created what one scholar terms "a permissive normative environment" for hostile intelligence activities. Adversaries can operate with plausible deniability, making it difficult to distinguish between state-sponsored operations, state-tolerated criminal activity, and genuinely autonomous action.

For close protection, the attribution problem manifests in two critical ways. First, the threat actor may be fundamentally unidentifiable, particularly in the case of lone actors radicalized through online content. As security experts have noted, "Lone actors are no longer alone online ecosystems—and now AI—are becoming participants in radicalization". The distinction between the individual and the algorithm that radicalized them becomes operationally irrelevant, but attribution to a specific adversary entity remains impossible. Second, even when a state-sponsored threat is suspected, the evidentiary threshold for public disclosure or response may be unattainable, leaving protective teams to manage a threat they cannot name or confront.

3. The Transformation of the Threat Environment: Empirical Evidence

3.1 The Lone Actor Renaissance

Perhaps the most significant development in the threat environment for close protection has been the re-emergence of the lone actor as the dominant attack modality. Lone actor attacks are not new—political assassinations by isolated individuals predate modern statehood—but the contemporary manifestation differs in critical respects from historical patterns.

Analysis of major security incidents from 2024–2026 reveals three distinctive characteristics of the contemporary lone actor threat. First, radicalization pathways have compressed dramatically. Traditional models of terrorist radicalization emphasized extended periods of social isolation, group affiliation, and progressive commitment to violent ideology. Contemporary lone actors, by contrast, may move from initial exposure to violent action in weeks or months rather than years. As one security expert observed following the Charlie Kirk assassination: "We didn't see any past violence with the Kirk assassin. What made them change so quickly and decide to kill?"

Second, the ideological content driving lone actor violence has fragmented and individualized. Traditional threat assessment frameworks emphasized identifiable ideological categories—political extremism, religious fundamentalism, single-issue activism. Contemporary attackers often present with hybrid or idiosyncratic belief systems that draw from multiple online sources, including gaming culture, memetic content, and personalized grievances. The Kirk shooter's practice of inscribing bullet casings with internet memes exemplifies this phenomenon: the attack was political in target selection but personal and cultural in symbolic expression.

Third, the lone actor is no longer truly alone in the sense of isolated from external influence. Online communities, algorithmic content delivery, and AI-powered engagement systems actively participate in the radicalization process. Individuals attempting to disengage from extremist content may be re-engaged by algorithmic recommendations designed to maximize engagement. The "lone wolf" metaphor, always partially misleading, has become actively dangerous if it implies operational independence.

3.2 Case Study One: The Charlie Kirk Assassination (September 2025)

The assassination of conservative activist Charlie Kirk at Utah Valley University in September 2025 represents a watershed event for close protection professionals, demonstrating multiple characteristics of the emergent threat environment.

The attack unfolded with lethal simplicity. Kirk was addressing an audience at an outdoor university venue, flanked by his security detail. A gunman positioned on a rooftop approximately 500 feet from the stage fired a single fatal round. The shooter, who had no documented history of violence or prior contact with law enforcement, had been radicalized online "in a fairly short amount of time," according to Utah Governor Spencer Cox.

Several features of this attack are analytically significant. First, the attacker exploited a gap in the protective perimeter that is common to outdoor events: the surrounding rooftops over which security teams lack jurisdiction. Kirk's security team acknowledged after the attack that "they do not have jurisdiction on the rooftops or the surrounding area" at university venues. This jurisdictional fragmentation—the division of security responsibility among multiple entities with different authorities and capabilities—represents a persistent vulnerability that contemporary attackers have learned to exploit.

Second, the attacker's weapon and position required minimal training or specialized capability. A commercially available rifle with optical sight, fired from a static position at a range of approximately 150 meters, demands marksmanship skills well within the capacity of an motivated amateur. As one former Secret Service agent noted, "a sniper at relatively close range and using optics on a rifle requires very little training to be lethal".

Third, the attack revealed the inadequacy of traditional protective methodologies against the long-range threat. Private security firms and government protective agencies "have developed a good approach to protecting individuals from the close in threat—handguns, sharp edge weapons, direct assault," but the sniper threat operates at distances beyond the traditional perimeter. This represents what might be termed the "asymmetry of range": defensive capabilities attenuate with distance more rapidly than offensive capabilities.

3.3 Case Study Two: The Brian Thompson Murder (December 2024)

The murder of UnitedHealthcare CEO Brian Thompson in December 2024 illustrated a different but equally significant dimension of the transformed threat environment: the executive as symbolic target and the use of violence as communicative act.

Thompson was approached and shot in a targeted attack that security experts have characterized as reflecting a broader trend: "violence is increasingly used as communication, and attackers no longer need proximity to create fear, disruption, or impact". The attack was not a random act of violence but a calculated communicative event designed to generate specific meanings for specific audiences.

The Thompson murder exemplified several emergent threat characteristics relevant to close protection. First, the selection of a corporate executive as target reflected the expansion of what might be termed the "target surface." Threat actors are increasingly viewing executives, board members, and business-unit leaders as high-impact symbolic targets, moving beyond traditional political and celebrity principals. Second, the attacker's pathway to violence did not follow traditional progressive escalation models, complicating behavioral threat assessment. Third, the symbolic nature of the attack meant that its impact extended far beyond the immediate victim, creating a demonstration effect that potentially inspires subsequent actors.

3.4 The Expanding Attack Surface: Physical Perimeters in the Digital Age

Both case studies illustrate a more fundamental transformation: the effective dissolution of the physical perimeter as a meaningful security boundary. Traditional close protection methodology operates on a concentric circle model: the principal at the center, surrounded by an immediate action team (IAT), an inner perimeter, an outer perimeter, and—ideally—a surveillance detection cordon. Each layer is designed to detect, delay, and defeat threats before they reach the principal.

Contemporary threats bypass this model in two critical ways. First, as the Kirk assassination demonstrates, the lethal threat may originate from positions outside any realistically enforceable perimeter. The 500-foot rooftop from which the shot was fired lies beyond the area that a protective detail can meaningfully secure without extraordinary resources and jurisdictional authority. Second, as the Thompson murder illustrates, the threat may be enabled by intelligence collection that occurs entirely outside the physical environment. Digital surveillance of the principal's movements, schedule, and vulnerabilities can be conducted from anywhere in the world, with the physical attack executed only when the intelligence picture indicates an opportunity.

This dual expansion of the threat surface—outward in physical space and into digital domains—requires fundamental reconceptualization of protective architecture. The question is no longer "how do we secure this perimeter?" but rather "what is the relevant battlespace, and how do we achieve advantage within it?"

4. The New Close Protection Paradigm: Intelligence-Led Protective Operations

4.1 From Reaction to Prediction: The Intelligence Imperative

The most significant shift required in contemporary close protection is the transition from reactive to predictive operational models. Traditional protective methodology is fundamentally reactive: advance work identifies potential hazards, perimeters are established to control access, and protective teams respond to identified threats as they emerge. This model assumes that threats will manifest within observable parameters and that response times will be adequate to interdict before harm occurs.

The transformed threat environment invalidates both assumptions. Threats may originate from outside observable parameters (the distant rooftop) or from within the principal's own digital environment (the compromised calendar). Response times, even when measured in seconds, may be inadequate against precision rifle fire from 500 feet or an attacker already within the inner perimeter.

The alternative is a predictive model that integrates intelligence collection, analysis, and dissemination as core protective functions rather than supporting activities. As one security professional observes, "Protective programs don't fail because people aren't paying attention—they fail at the seams. Bridging intelligence, behavior, and physical threat detection is no longer optional".

The predictive model requires three integrated capabilities. First, continuous threat intelligence collection across open, closed, and social sources. This includes traditional HUMINT and classified sources where available, but increasingly relies on OSINT collection and analysis as the primary means of identifying emergent threats. Second, behavioral threat assessment that tracks potential attackers through the pathway to violence, identifying intervention points before the attack becomes imminent. Third, predictive analytics that identify patterns and anomalies indicating increased risk, enabling preemptive protective adjustments.

4.2 Asymmetrical Perimeter Theory

This article proposes the concept of "asymmetrical perimeter theory" as a framework for understanding and addressing the contemporary threat environment. The term has two referents. First, descriptive: the contemporary threat environment is characterized by asymmetries in capability, range, and detection between attackers and defenders. Attackers can operate at distances and through domains where defensive capabilities are systematically weaker. Second, prescriptive: effective protective architecture must be deliberately asymmetrical, concentrating resources where threat is most likely and vulnerabilities are greatest, rather than attempting uniform coverage.

Asymmetrical perimeter theory has several operational implications. The traditional concentric circle model is replaced by a threat- and vulnerability-weighted model. Long-range ballistic threats receive different countermeasures than close-range edged weapon threats; digital threats receive different countermeasures than physical threats. Resource allocation follows risk rather than geometry.

Operationally, asymmetrical perimeter theory demands that protective teams abandon the assumption of comprehensive security in favor of targeted intervention capability. It is not possible to secure every rooftop within 500 feet of every venue where a principal appears. It is possible to conduct systematic line-of-sight analysis, establish deterrent presence on the most threatening positions, and design venue layouts that break sightlines to remaining vulnerabilities. It is not possible to prevent all digital compromise of the principal's information. It is possible to conduct digital footprint reduction, monitor for anomalous access, and maintain operational security protocols that limit the value of compromised information.

4.3 Digital Footprint Management as Protective Function

The transformation of OSINT from supplementary collection discipline to primary threat intelligence source has profound implications for close protection. As one scholar argues, "the line between 'intelligence' and 'OSINT' is no longer a meaningful distinction in the digital age". For protective purposes, the question is not whether information is "open source" but whether it is accessible to potential attackers.

The concept of "digital footprint management" must therefore become a core protective function. This includes systematic reduction of the principal's publicly accessible information—social media activity, property records, association memberships, travel patterns, family information—to the minimum necessary for professional and personal function. It includes active monitoring for information leakage through the principal's network: associates who post location information, family members who share photographs, employees who maintain unsecured calendars. It includes proactive management of the principal's digital identity to create a controlled public persona separate from operational reality.

This represents a significant cultural and practical challenge for many principals, particularly those whose professional success depends on public visibility. Corporate executives, political figures, and celebrities cannot simply disappear from public view. The protective function must therefore work with principals to identify acceptable trade-offs between visibility and vulnerability, implementing graduated protections calibrated to the threat environment.

4.4 The Integration Requirement: Uniting Intelligence and Physical Protection

The most significant structural challenge in implementing intelligence-led protective operations is organizational. Traditional close protection and traditional intelligence collection operate in different institutional cultures, with different personnel pipelines, different authorities, and different accountability mechanisms. Protective teams are action-oriented, physically present with the principal, and operate on compressed timelines. Intelligence analysts are information-oriented, often remote from the principal, and operate on extended analytic timelines.

The new paradigm requires integration of these functions. As one security professional notes, the failure points in protective programs are "communication seams"—"reporting delays, HR–Security gaps, and unactivated protective intelligence remain common failures. The issue is rarely information—it's integration".

Integration has structural, procedural, and cultural dimensions. Structurally, protective teams require dedicated intelligence personnel who are embedded in protective operations rather than supporting them from a distant analytic cell. Procedurally, intelligence products must be formatted and disseminated on timelines that support protective decision-making rather than analytic convenience. Culturally, protective and intelligence personnel must develop shared operational frameworks and mutual trust—a process that requires deliberate investment in cross-training and joint exercises.

5. Conclusion: The Close Protection Professional as Counterintelligence Practitioner

This article has argued that the transformation of counterintelligence in the digital age has fundamentally altered the threat environment for close protection, requiring a corresponding transformation in protective methodology. The traditional model—reactive, physically focused, perimeter-dependent—is no longer adequate to anticipate or interdict contemporary threats. The emerging paradigm—predictive, intelligence-led, asymmetrically perimetered—represents not merely an evolution of existing practice but a rupture with foundational assumptions.

For the individual close protection practitioner, this transformation carries profound implications for professional identity and competency requirements. The protective agent who cannot conduct OSINT collection and analysis, who does not understand the radicalizing potential of algorithmic content delivery, who lacks the capacity to integrate intelligence products into tactical decision-making, is no longer merely less effective—they are operationally obsolete.

The training pipeline for close protection professionals must therefore be fundamentally reconceived. Traditional physical skills—firearms proficiency, defensive tactics, medical response, driver training—remain necessary but are no longer sufficient. They must be complemented by analytic skills: open-source collection methodology, behavioral threat assessment, predictive analytics literacy, and intelligence report writing. They must be complemented by digital skills: footprint management, social media monitoring, encryption and operational security, and familiarity with AI-driven analytic tools.

More fundamentally, the professional culture of close protection must shift from the tactical to the strategic. The protective agent must think not only about the immediate physical environment but about the broader intelligence environment in which threats develop. They must understand their principal not only as a person to be physically protected but as a node in a contested information space where every piece of publicly available data is a potential weapon.

This is, in the final analysis, the central argument of this article: close protection has become the tactical edge of modern counterintelligence. The same technologies, methodologies, and analytic frameworks that protect national secrets now protect individual lives. The protective professional who fails to understand this will fail to protect their principal. The profession that fails to adapt will become irrelevant, replaced by a new discipline that emerges from the integration of intelligence and protection that this article has described.

The paradox of proximity is that distance no longer protects. The attacker at 500 feet, the compromised calendar on a server in another country, the algorithm that radicalizes without visible cause—these are not peripheral concerns for the close protection professional. They are the central reality of the contemporary threat environment. To protect against them requires not a larger perimeter but a different way of thinking about security entirely.

References

[1] Watters, P. A. (2024). Counterintelligence in a Cyber World. Springer.

[2] CNN. (2025, September 27). "Snipers in this highly charged political climate are a wake-up call, security experts say." CNN.com.

[3] Thibert, J. (2026, March 24). "Redefining Espionage: The Unseen War for Technological Dominance." Global Security Review.

[4] Rovner, J. (2020). "What is an intelligence contest?" Texas National Security Review, 3(4), 114-120.

[5] Zegart, A., Rovner, J., Warner, M., Lindsay, J., Maschmeyer, L., & Chesney, R. (2023). "Cyber conflict as an intelligence contest." In Deter, Disrupt, or Deceive. Georgetown University Press.

[6] Randolph, C. (2025, December 15). "Charles Randolph's Reflection on Brian Thompson's Murder: Threat Landscape Accelerates." LinkedIn.

[7] Maguire, P. (2024, October 1). "Integrating Evolving Technology for Intelligence to Counter Modern Threats." Security Management Magazine, ASIS International.

[8] Hatfield, J. M. (2024). "There Is No Such Thing as Open Source Intelligence." International Journal of Intelligence and CounterIntelligence, 37(2), 397-418.

[9] IEEE Xplore. (2024). "Nation-State Cyber Operations." In Cybersecurity and Intelligence. IEEE.

[10] Warner, M. (2018). "Wanted: A Definition of 'Intelligence.'" Studies in Intelligence, 62(3).

[11] Deibert, R. (2021). Reset: Reclaiming the Internet for Civil Society. House of Anansi Press.

[12] Gioe, D. V., & Hatfield, J. M. (2021). "A damage assessment framework for insider threats to national security information: Edward Snowden and the Cambridge Five in comparative historical perspective." Cambridge Review of International Affairs, 34(5), 704-738.

[13] Hafez, M. M., & Hatfield, J. M. (2006). "Do targeted assassinations work? A multivariate analysis of Israel's controversial tactic during Al-Aqsa uprising." Studies in Conflict & Terrorism, 29(4), 359-382.

[14] Rovner, J. (2019). "Cyber war as an intelligence contest." War on the Rocks, 16, 260-278.

[15] Rovner, J. (2013). "Intelligence in the Twitter age." International Journal of Intelligence and CounterIntelligence, 26(2), 260-271.

[16] Talmadge, C., & Rovner, J. (2023). "The meaning of China's nuclear modernization." Journal of Strategic Studies, 46(6-7), 1116-1148.

[17] Hatfield, J. M. (2018). "Social Engineering in Cybersecurity: The Evolution of a Concept." Computers & Security, 73, 102-113.

[18] Rovner, J., & Long, A. (2005). "The perils of shallow theory: Intelligence reform and the 9/11 commission." International Journal of Intelligence and Counterintelligence, 18(4), 609-637.

[19] Rovner, J., & Moore, T. (2017). "Does the internet need a hegemon?" Journal of Global Security Studies, 2(3), 184-203.

[20] Wackrow, J. (2025). Commentary on sniper threat environment. CNN.com.

[21] Hamilton, J. (2025). Analysis of protective security vulnerabilities. CNN.com.

[22] Kolvet, A. (2025). Statement on Charlie Kirk security limitations. The Charlie Kirk Show

[23] Rovner, J. (2011). Fixing the facts: National security and the politics of intelligence. Cornell University Press.

[24] Gioe, D. V., Hatfield, J. M., & Stout, M. (2020). "Can United States Intelligence Community Analysts Telework?" Intelligence and National Security, 35(6), 885-901.

[25] Rovner, J. (2017). "Two kinds of catastrophe: nuclear escalation and protracted war in Asia." Journal of Strategic Studies, 40(5), 696-730.