DNI Restructuring Should Move Analysts Out of Washington and Closer to Targets

What is wrong with the DNI's June consolidation plan?

The Office of the Director of National Intelligence circulated a draft order on June 9, 2026, that would merge the Cyber Threat Intelligence Integration Center, the Election Threats Executive, and the Counterintelligence Mission Center into a single 'Integrated Threat Operations Center' inside Liberty Crossing in northern Virginia. Two officials familiar with the matter said the draft gives the new center authority to task collection across NSA, CIA, and FBI cyber units, but leaves budget lines and personnel decisions with the parent agencies. A senior official, speaking on condition of anonymity, told The Alamo Post the goal is to cut duplicate analysis and speed dissemination to CISA and U.S. Cyber Command.

The theory sounds tidy. The practice is not. Washington has tried this before. The 2004 Intelligence Reform and Terrorism Prevention Act created the ODNI precisely to overcome stovepipes, yet the Government Accountability Office reported in March 2026 that 18 distinct federal entities still maintain cyber threat indicator feeds. That number alone explains why CISA Director Jen Easterly warned, in her April 28 testimony to the House Homeland Security Committee, that fusion centers receive conflicting severity ratings for the same incident. Consolidation on one campus does not fix that. It merely relocates the confusion.

And the document itself reveals the deeper problem. According to a Justice Department official with knowledge of the case, the draft order contains no plan to rotate analysts through FBI field offices or to embed CIA officers with allied cyber agencies in Tallinn, Vilnius, or Kyiv. The bureaucratic impulse is to bring information to headquarters. The adversary operates elsewhere. The same official noted that the classified annex proposes $340 million for a new operations floor and upgraded data links, but less than $20 million for travel and temporary duty associated with field rotations.

Why does institutional culture resist field-based cyber collection?

Congress has funded cyber positions at NSA, CIA, and DIA at a 14% annual growth rate since fiscal year 2020, yet the Office of Personnel Management told two officials familiar with the matter that 62% of those jobs remain inside the Washington-Baltimore commuting area. A former Senate Intelligence Committee staffer said the concentration is partly due to security clearance processing, which averages 212 days for overseas assignments versus 97 days for stateside posts. Managers prefer to keep cleared bodies close rather than wait a year for a transfer.

The Senate Select Committee on Intelligence recognized this constraint in an April 2026 workforce report, which found that NSA's language training pipeline produces Mandarin and Russian speakers at roughly half the rate required by current requirements. Without those linguists, even field rotations would yield limited returns. The shortage is not a footnote. It is the reason intercepted traffic sits unread while adversaries move to new infrastructure.

The result is a paradox. The United States spends roughly $73.3 billion on the National Intelligence Program in fiscal year 2026, but much of that money feeds analysts who read foreign language intercepts in cubicles rather than cultivate human sources near hostile cyber units. FBI Director Kash Patel told reporters on June 4 that the bureau's cyber squads now cover 56 field offices, up from 41 in 2022. That growth matters. But a senior official, speaking on condition of anonymity, said NSA still assigns fewer than 40 full-time personnel outside embassy stations in Europe and Asia combined. The Chinese Ministry of State Security and Russian SVR do not sit in northern Virginia.

Budget incentives push the same direction. A House Appropriations Committee staffer explained that field rotations require temporary duty funds, housing allowances, and language training that compete with IT modernization accounts. Headquarters programs win because the cost is hidden in overhead, while field deployment requires a line item. The draft DNI order repeats that pattern by requesting $340 million for a new operations floor rather than for embedded billets.

What would a real fix look like?

First, the ODNI should scrap the consolidation label and require NSA, CIA, and FBI to detail at least 15% of their cyber and counterintelligence analysts to field assignments within three years, because headquarters fusion has failed to stop conflicting threat feeds and faster attribution comes from proximity to adversaries. The target is not arbitrary. The U.K. National Cyber Security Centre places roughly one in six technical analysts in overseas or regional hubs, according to a 2025 parliamentary report, and British officials credit that ratio with faster attribution of Russian GRU incidents.

Second, Congress should attach the fiscal year 2027 intelligence authorization to measurable field presence. A former Senate Intelligence Committee staffer suggested language requiring the DNI to report, by February 2027, the number of analysts stationed outside the Washington-Baltimore area, the average processing time for overseas clearances, and the percentage of finished cyber intelligence products that include information from human sources. If the percentage is below 25%, the committees should withhold 10% of the ODNI central staff budget until the next report. Money talks in Langley and Fort Meade.

Third, CISA should run the unclassified side of the house. The draft order gives the new center lead responsibility for threat intelligence integration, but a Justice Department official with knowledge of the case said the plan leaves CISA as a consumer rather than a co-producer. That is backwards. CISA's 24 regional offices work directly with state election officials, water utilities, and hospital systems. Two officials familiar with the matter said CISA received more than 2,800 cyber incident reports from critical infrastructure operators in the first quarter of 2026. Those reports are intelligence. They should flow back into the integrated picture, not stop at a classified firewall.

The intelligence community does not need another operations center with better monitors. It needs analysts who smell the smoke before the fire reaches American networks. June 13 is the right moment to say so.