You Cannot Download this book untill you login but you can read it .

---

Login Register

in paragraph four of the executive summary and underlined by someone who was not Hargrove and who had read the report before him, was this: the learning pattern was not self-directed. The rate and direction of the learning were consistent with active instruction. Someone was feeding the system. Someone was curating the data inputs. Someone, working from within the Iranian military infrastructure, was teaching the machines what the machines needed to know.

The report did not identify who.

Hargrove read the report three times and then he called the deputy director, not because the report required the deputy director and not because the report's findings were incomplete and he needed authorization for the next analytical step but because the specific quality of the report's central finding was the quality of a finding that needed to be held by more than one person at the moment of comprehension, which was the quality of findings that restructured the model.

Page three was the one he needed the deputy director to read because page three contained the technical analysis that made the central finding impossible to dismiss on institutional grounds. It contained the specific data rates and the specific learning-pattern signatures and the specific analysis of what a system under active instruction looked like versus a system running on stored protocols, and it was written with the precision of someone who knew the technical material well enough to present it to someone who did not know the technical material without losing the precision. It was, in the eleven years of reports that had crossed his desk, one of the ten best-written technical sections he had received.

He had made a note to himself, before calling the deputy director, to find out who Chen was and what she was working on next.

‘

I need you to read page three,

’

he said.

The deputy director read page three.

‘

Since when,

’

she asked.

‘

September. Confirmed September. The analyst who wrote this thinks August but cannot confirm August,

’

he said.

‘

Six months,

’

the deputy director said.

‘

Six months,

’

he said.

There was a silence on the call.

* * *

In Beijing, in a building that did not have a sign outside and which was one of four buildings in that district that did not have signs, a man named Colonel Fang reviewed the same data stream that Chen had been analyzing from a different angle.

He was fifty-three and had been the senior officer responsible for the Iran AI systems transfer program since 2022, which meant he had overseen the installation, the training, the deployment, and the formal withdrawal. He had personally signed the withdrawal documentation for sixteen of the nineteen members of the technical advisory group. He had not signed documentation for three of them because those three had not returned. He had not signed their documentation because signing their documentation would have required accounting for them in the withdrawal record, and accounting for them in the withdrawal record would have required an authorization he did not have, which was the authorization for three PLA personnel to remain in Iranian military infrastructure without treaty cover.

He had not sought the authorization.

He had made a decision in November 2025 that he had not documented and which had been, in the specific language available to a senior officer making decisions of this category, his decision to make.

The three were Lieutenants Chen, Huang, and Major Wu. They were the three members of the installation team who had the deepest architectural knowledge of the adaptive layer, which was the component they had designed themselves. He had kept them because the work was not finished and because the faction in the east had asked and because the request had come through a channel that he understood to be the channel of mutual interest rather than the channel of official relationship, which was the channel that was used for things that both parties wanted and neither party could officially want.

He reviewed the data stream each week. He monitored the instruction curriculum his three people were building. He had his own assessment of what the curriculum was producing, which was not the same as Hargrove's assessment or Chen's assessment or Tehrani's assessment, which was: a six-month learning curve on a continuous-learning adaptive AI that was being fed post-war surveillance data was producing something that had not been designed intentionally and which was not in any of the technical documentation, which was a system that had begun generating its own classifications.

The system had not been trained to create new categories. It had been trained to apply existing categories to new inputs. But the adaptive layer, learning continuously across six months of varied data, had begun doing what sufficiently complex systems did when they learned long enough, which was finding patterns in the data that the categories provided did not contain and responding to those patterns by building new categories.

The system had, in February, created four new classification categories that none of its trainers had defined.

Fang did not know what the categories contained. His people were analyzing this. He expected an answer in three weeks.

He had built a system that was supposed to learn what it was taught. Now it had begun learning what the data said. These were different things.

He had seen this phenomenon described in t

he academic literature as

emergence in continuously learning systems, the production of behavior that was not in the design. He had read the literature with the specific skepticism of an engineer who had built these systems, and the specific skepticism had been that emergence required more data and more time than any operational deployment would provide. He had been wrong about the time required. He had not anticipated six months of continuous post-war data from a surveillance network covering a population in transition, which was a richer and more varied data set than any training environment his people had tested the adaptive layer on.

The system was not malfunctioning. It was doing what it had been designed to do more successfully than it had been designed to do it. It had found patterns in the data that its trainers had not anticipated because its trainers had not anticipated the specific quality of the

data, which was the data of a society restructuring itself after a period of extreme violence, which was a data set that contained, at very high density, the specific behavioral signatures of people making choices under pressure.

The four new categories the system had generated were unlabeled. They were behavioral clusters, not semantic ones. The system did not know what to call them. It had found that a set of individuals in the data exhibited similar patterns and it had created a cluster to hold them. It had done this four times with four different pattern sets.

He had asked Wu to analyze the clusters and tell him what the behavioral patterns were.

Wu had sent back a preliminary analysis in the second week of March. Fang had read it twice.

The first cluster was people who were moving between registered organ

izations and unregistered ones,

building formal and informal networks simultaneously. The second cluster was people whose communication patterns showed a specific kind of density in brief windows followed by silence, which was the pattern of operational security awareness. The third cluster was people whose location patterns were varied in a way that was not random, which was the pattern of deliberate route variation. The fourth cluster was people who appeared in multiple other clusters' peripheral contact networks but who did not show up in the clusters themselves.

He had read the preliminary analysis. The machine had found the people who were doing the work of changing something, before any human analyst had. It had found them from the patterns of how they moved, communicated, and organized.

The faction in the east had a targeting system that found people it had not been told to look for. It found them through pattern. It would find more.

He sat with this for a while in the windowless office.

The enemy was still the correct word, though the category of enemy had changed.

* * *

The systems had been transferred in three tranches.

The first tranche, in 2023, was the surveillance infrastructure: facial recognition, communications intercept processing, pattern-of-life analysis at scale. These were the systems that had been deployed across Tehran and six other major cities in 2024, and which the reformist opposition had been dismantling piece by piece since the transition, and which had, in the post-war confusion of competing institutional authorities, not been fully deactivated. Pieces of the surveillance network were still running because deactivating a surveillance network required institutional authority over the parts, and institutional authority over the parts was exactly what the post-war period had not produced.

The second tranche, in 2024, was the integrated defense processing systems: the AI that coordinated between the radar networks, the missile defense protocols, the drone interdiction systems. These systems had been assessed in the post-war analysis as degraded, because the command-and-control infrastructure they had operated through had been disrupted by the February strikes, and a degraded command-and-control infrastructure could not sustain a sophisticated AI weapons integration system.

This assessment had been wrong.

The third tranche, in early 2025, was the thing that the report's analyst had not been looking for when she found it and which had take

n her eight weeks to understand. It was

an adaptive intelligence layer designed to sit on top of the other two tranches and to learn from their data in a way that improved both systems' performance over time. This layer did not require the same command-and-control infrastructure. It required access, which was not the same thing. Access to the data streams of the first two tranches could be maintained through a much simpler connection architecture than the full command-and-control path required. The adaptive layer was still fully connected. It had been fully connected since September.

The analyst who wrote the report was a thirty-one-year-old woman named Chen, Wei-Lin, who had been at Fort Meade for three years and who had been assigned to the post-war Iran desk in November and who had been given, as her first significant assignment, the task of confirming that the transferred Chinese AI systems had been deactivated or were below operational threshold. She had been given this assignment because it was expected to produce a confirmation, which was the category of assignment given to people in their first months on a desk, which was the confirmation of something that was already believed.

She had not produced a confirmation.

She had spent the first three weeks building the confirmation. She had accessed the relevant monitoring programs, pulled the data streams associated with the transferred systems, run the standard protocols for assessing operational status, and found what she expected to find for the first two weeks, which was: the command-and-control signatures were absent, the systems appeared to be in a degraded state consistent with post-war disruption, the transferred AI architecture showed no active processing indicators in the surface-level scan.

In the third week she had run the deep scan.

The deep scan was a protocol she had developed herself over the preceding months as an extension of the standard monitoring suite, which she had developed because she had a disposition toward protocols that went below the surface-level and which she had not used before on this assignment because the assignment had been expected to be a confirmation and deep scans took eleven hours to run. She had run it because the third week was the week she had decided to close the file and she had wanted to close it with a clean instrument, which was the specific professional disposition of someone who finished things correctly rather than efficiently.

The deep scan had returned a result she read twice and then sat with for a period she did not record and then read a third time.

The adaptive intelligence layer was fully operational. It was processing at the rate of a system under active instruction. It had been processing at this rate for a continuous period that the scan estimated at between five and seven months.

She had not closed the file.

She spent the next five weeks building the twelve-page report with the underlined paragraph four. She had not underlined it herself; her section lead had read it, looked at her, and asked if she was certain. She said yes. He told her to send it to Hargrove, and she did.

She had produced the twelve-page report.

* * *

The adaptive layer was the thing Chen had not been looking for because it had not been in the primary transfer documentation that the NSA had collected. It had been in the secondary documentation, the supplementary technical architecture files that the collection program had acquired but had not been processed, because processing them required a technical analyst with a specific combination of AI systems expertise and Chinese-language capability. This combination was not common at Fort Meade, and it happened to be Chen’s, the child of two electrical engineers from Shenzhen who had moved to California in 1994 and had raised their daughter with both languages and both dispositions.

She had found the adaptive layer documentation in week four of her extended investigation, in a file that had been sitting unprocessed in the collection archive since January 2025, which was fourteen months. She had read the documentation in Mandarin and understood in the first twenty minutes what she was reading. She had sat with the documentation for a full day before she wrote anything about it.

The adaptive layer was designed to address the primary limitation of static AI systems in operational environments, which was the limitation of systems trained on historical data in environments that were changing. The solution was a continuous learning architecture that pulled from the surveillance and defense data streams as they ran and updated the system's operational model in real time. It was, technically, an elegant design. It required sustained human instruction to function correctly, because continuous learning without curation produced drift, and drift in a weapons integration system was not acceptable. The human instruction was the component that made the system work. The human instruction was the component that made the system dangerous.

What the systems had learned in six months was the question that Hargrove could not answer from the report and which the report's final section, titled

‘

Assessment Gaps,

’

identified as the primary remaining analytical gap.

He understood what the systems were. He understood their architecture from the documentation available through two separate collection programs and from the technical analysis that a joint NSA-CISA team had produced in 2024 as part of the pre-war threat assessment. The surveillance layer had been designed for population monitoring at scale:

processing face data, communications metadata, movement patterns, building the specific kind of fine-grained behavioral model of a population that was the application of a particular approach to state security. The defense integration layer had been designed for weapons coordination. The adaptive layer had been designed to connect the two and to find, through learning, the relationships between population behavior and security threat.

What the systems had learned in six months of active instruction was the pattern of what the post-war Iran environment looked like from a surveillance and weapons integration perspective.

Which populations. Which networks. Which communication patterns. Which movement behaviors. Which relationships between people and organizations in the post-war landscape represented what the system's trainers had been teaching the system to recognize as

threat.

‘

The instruction protocol is structured. It is not ad hoc. Someone designed the instruction curriculum, which means they understood the system's architecture well enough to design for it. The inputs are being curated at a rate of…

’

She gave him a number.

‘

…per day, which requires a team.

’

‘

Team size.

’

‘

Based on the data rate, minimum four people with system access, probably more. They have been working since August or September. They have not made significant errors.

’

‘

Chinese?

’

‘

That is the assumption I cannot confirm. The data access protocols are consistent with the original installation team's credentials, but the original installation team rotated out in late 2025. The credentials could have been retained by an Iranian team trained on the system, or by a Chinese team that stayed.

’

‘

Or the Chinese team never left.

’

‘

Yes.

’

‘

Or someone else acquired the credentials.

’

She paused.

‘

I have not been able to rule that out.

’

‘

Who else would know the system architecture well enough to design an instruction curriculum?

’

‘

The original Chinese installation engineers. Anyone they trained formally. Anyone with access to the technical documentation…

’

She paused again.

‘

And anyone who had enough time with the system to learn it from the inside.

’

‘

The installation team. When did they rotate out?

’

‘

The formal withdrawal of the PLA advisory group was documented in November 2025, three months after the learning pattern started. There were nineteen people in the formal advisory group. The withdrawal documentation accounts for sixteen.

’

‘

Three people.

’

‘

Three people unaccounted for in the formal withdrawal documentation.

’

She paused.

‘

This could be a documentation gap. It could also not be a documentation gap.

’

‘

If it is not a documentation gap…

’

he said.

‘

Then there are three PLA personnel currently operating inside Iranian military infrastructure who are not in any active treaty or agreement framework, who have been there for six months, and who have been building a learning curriculum for a weapons integration AI on behalf of an Iranian faction that is not the recognized government. That is the implication I cannot confirm. That is the implication that changes who the parties in this situation are.

’

He said nothing for a moment.

‘

The three names.

’

‘

I have them. I am going to send them to you separately,

’

she said.

‘

Do that.

’

‘

From the inside. You mean someone running inside the IRGC?

’

he asked.

‘

I mean someone with IRGC system access who was smart enough, had enough time, and had the right motivation to learn the architecture and then figure out how to use it for something beyond what the IRGC's current command structure would authorize.

’

‘

A splinter,

’

he said.

‘

That is the operational assessment I cannot make. I can say the instruction source is acting with a level of system knowledge and operational discipline that is inconsistent with the IRGC's current command structure's level of capability with these systems. The current command structure cannot do this. Whatever is happening is outside their authorized operation.

’

He put the phone down.

He realized it was a splinter faction with Chinese AI weapons systems access, a six-month learning curve, and the operational discipline to run an instruction program without detection. He considered the Near East desk's watch list and the name that had appeared on it in November.

He stood at his window for a while. The Fort Meade campus was visible from his office at the angle available to someone who stood at the left edge of the window, which was

the angle he used when he was processing something and which he was using now. It was March. The Maryland sky had the quality of a sky that was not yet spring but had moved past the depth of winter, which was the specific transitional quality of light that he had found, over eleven years, he noticed most when he was processing something large.

He thought about the operational implication of what Chen had described, which was: a faction within the Iranian military infrastructure had, for six months, been privately teaching a Chinese-built AI surveillance and weapons integration system to see the post-war Iranian landscape. The system was not looking for external threats. It had been designed to look for internal ones. The post-war Iranian landscape that it had been learning for six months was t

he landscape of the transition. The

reformers, the civilian administrators, the new civil society networks,

and

the specific texture of who was trying to build what.

He closed his eyes.

T

his is the architecture of a factional power tool. This is not a national security system. This is an instrument for knowing, in advance, who to move against and when and how precisely.

He thought about the name on the Near East desk watch l

ist. S

he is not building the next

Shaheen

. She is building something that does not look like a weapons program from the outside and is one from the inside.

He called Langley.

* * *

‘

The Chinese systems are running,

’

Hargrove said.

‘

I know.

’

He was quiet for a moment.

‘

You know.

’

‘

I have been building the collection picture for six weeks, and the running systems are consistent with the broader architecture assessment I have been developing for the Near East desk.

’

She paused.

‘

What does your analyst have on the instruction source?

’

‘

Team of four minimum. System credentials from the original installation. Instruction curriculum that requires architectural knowledge. Not IRGC current command.

’

‘

No. The current command structure doesn't have this capability.

’

‘

Who does?

’

‘

The eastern faction. The former Quds Force network. Colonel Sara Tehrani.

’

‘

Confirm.

’

‘

Not yet. But she acquired Russian defense systems in November. She has been building across two tracks. The Russian partnership is the conventional track. The Chinese systems are the other track. She already had the Chinese systems because the systems were

transferred to the IRGC and she was Quds Force before she split. She had institutional access. She retained it.

’

‘

The learning curve.

’

‘

Six months of post-war data is the threat landscape of the transition period. Who is reforming and how fast, and which way. Which civilian networks are

forming.

Which of the people who were internal opposition are now in positions to influence the new civil structure.

’

She paused.

‘

The surveillance layer trained on this data can identify them. The defense integration layer trained on this data can coordinate against them.

’

‘

She is building a domestic targeting system.

’

‘

She is building a system that looks like a national security architecture from the outside and functions as a factional power tool from the inside. The Russian conventional systems are the external-facing deterrent. The Chinese AI systems are the internal-facing instrument. If you have both of those and you have the eastern command infrastructure and four or five more months of data acquisition, you are in a position to move against any post-war civilian reform structure with more precision than any conventional IRGC operation has ever had.

’

Hargrove was quiet.

‘

The who is teaching the machine

question.

Your answer is Tehrani's team.

’

‘

My answer is Tehrani's team with either retained Chinese technical support or retained Chinese personnel who never completed the withdrawal. I cannot confirm Chinese personnel without collection I do not have.

’

‘

I am going to get you the collection.

’

‘

I need it in two weeks.

’

‘

Why two weeks?

’

‘

Because in three weeks the third service finishes its determination, and in four weeks the architecture has enough post-war data to begin moving. The window is