Loading today’s stories
Security1 distinct publisher3 min readPublished
The agency is rebuilding its most secretive intrusion unit by pitching the people who already left, and the invitations ran through an outside nonprofit and a 250-plus alumni chat.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
An invitation-only channel is a roster before it is anything else. Multiple sources shared screenshots with Recorded Future News, on condition they not be published, showing that Kosiba was an active contributor to the group before he left it [16]. The membership also includes earlier TAO technical directors, at least one former head of the NSA's Cyber Directorate, and operators who went on to Project Maven, the Defense Department's AI effort [17].
The routing is worth noting. NSA's first attempt to gather the group ran through the National Cryptologic Foundation, an education and preservation nonprofit that is not part of the agency [11], before the Signal channel was stood up [12]. Whatever the intent, the effect is that the assembled list of former operators sits outside government systems.
The two members quoted do not agree on what that list amounts to. One said nobody had gone classified, and in the same breath that internal security would come apart if it saw the channel [13]. The other called the traffic mostly benign, said it ran from shift-floor in-jokes to the results of an operation, and put the audience at more than 250 people of whom about ten would understand any given reference [14]. He then said access would be worth twenty stories [15]. Both readings can hold. Discreet reminiscence, aggregated across 250-odd identified people whose job was breaking into foreign systems and leaving software behind to collect for months or years [5], is the same collection geometry the unit itself was built to exploit.
Signal is ordinary inside NSA and the wider clandestine community [18], so the app is not the finding. Membership is. The Pentagon inspector general concluded that Defense Secretary Pete Hegseth put troops at risk by sharing plans for an upcoming strike in Yemen from his personal phone, and criticized the use of unapproved messaging [19]; that is a content failure. A channel that grew into the hundreds on invitation alone is a targeting problem instead, which is presumably why some participants have asked whether the agency took unnecessary risks to publicize the event [10].
The recruiting read is the more durable one. Kosiba, a former TAO technical director, has made reviving the organization a priority since returning as deputy director this year, according to people who spoke anonymously [c6b], and what he is scheduled to deliver on Friday, after the building tour, is a sales pitch to people who have already resigned [8]. The reporting does not say why they left, what they earn now, or how many will come back. It does say the agency judged a personal appeal from its number two to be the right instrument [8]. That is not how an employer behaves when the applications are arriving.
Against the rest of the agency's outreach, the target has moved. The 2019 Cybersecurity Directorate was aimed at the private sector and other federal agencies [3]. The 2024 podcast was aimed at the public [4]. Friday is aimed at former staff [20]. If you employ ex-TAO people, or you have been trying to, the organization that trained them is bidding at a homecoming you were not invited to [1][2].
Ranked by verification strength, evidence, and original report placement.
The get-together has been in the works since the spring and was largely spearheaded by NSA Deputy Director Tim Kosiba, according to multiple sources who spoke on condition of anonymity.
Kosiba previously worked in TAO and served as its technical director, and has made revitalizing the organization a priority since returning to take the No. 2 job earlier this year, according to those same anonymous sources.
Multiple sources shared screenshots of the Signal group chat with Recorded Future News, on condition they not be published, showing that Kosiba himself was an active contributor at one point, though he later left.
Other notable participants in the chat include previous TAO technical directors, at least one former head of the NSA Cyber Directorate, and operators who eventually joined Project Maven, the Defense Department's AI effort.
The National Security Agency will host a first-of-its-kind reunion on Friday for alumni of Tailored Access Operations (TAO), welcoming potentially hundreds of former members back to campus at Fort Meade, Maryland.
The reunion is intended to celebrate the division's recent rebranding and to attempt to lure alumni to come back inside the fence line at Fort Meade.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Original reporting, but single-outlet and largely anonymous
The cluster is one exclusive built on multiple anonymous sources, attendee accounts and screenshots the outlet agreed not to publish, with NSA declining to comment and the agenda not public. The reporting is specific and internally consistent, but nothing here is independently verifiable or corroborated by a second publisher.
Event and alumni channel are real; rehiring results unknown
Concrete uptake is documented at the channel level: an invitation-only Signal group ballooned to 250-plus alumni including former technical directors and a onetime Cyber Directorate head, and a physical reunion with a building tour and recruitment pitch is scheduled. What is absent is any measured outcome - no reported rehires, headcount goals, or retention change - so adoption of the underlying strategy is unproven.
Slightly overstated: rebuild framing outruns reported outcomes
The framing of rebuilding a secretive intrusion unit is modestly ahead of the evidence, which documents an invitation list, a group chat and a scheduled pitch rather than any return of personnel. The story's own hedges pull the gap back toward alignment: it notes the reunion 'won't move the spy service further out of the shadows,' that the agenda is not public, and that members call the chat 'mostly benign.'
Recruitment, reputational and scoop incentives all in play
Documented incentives run in several directions: NSA leadership is courting alumni to reverse churn in its most operational unit, and the effort is championed by a deputy director who once ran TAO's technical shop; alumni sources speak anonymously about a channel some of them fear would alarm internal security; and the outlet holds an exclusive whose value depends on the chat's sensitivity. Routing invitations through an outside nonprofit also shifts institutional exposure away from the agency.
Moderate-low: credible specifics, unverifiable base
Confidence is limited by structural factors rather than internal contradictions: one publisher, anonymous sourcing, unpublished screenshots, an agency no-comment, and no outcome data. The claim set is coherent and richly detailed, which supports the descriptive facts, but any conclusion about the rebuild succeeding is currently unsupported.
product
Proton's Yen stops refusing AI and ships Lumo, moving the privacy fight to terms1 distinct publisher
security
CMMC Phase 2 is suspended. DFARS 252.204-7012 is not.1 distinct publisher
security
Gunra Goes Franchise: Conti's Leaked Code Now Ships With a Builder and an Affiliate Panel2 distinct publishers
product
White House lets vetted firms hack back and leaves liability blank for 60 days1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 26, 2026