CIA Cyber Mission Center Pinpointed Maduro for Special Forces in Four Minutes

The CIA's Cyber Mission Center built the targeting intelligence that let U.S. Special Forces locate and apprehend Venezuelan President Nicolás Maduro within four minutes of landing in Caracas on January 3 — a disclosure that marks the first time a senior American intelligence official has publicly confirmed, on the record, that offensive cyber operations now enable U.S. kinetic special operations as a routine matter.

CIA Deputy Director Michael Ellis made the disclosure Tuesday at the 17th Annual Billington CyberSecurity Summit in Washington, D.C., describing Operation Absolute Resolve as the proof-of-concept for what the agency's reorganized Cyber Mission Center can do — and offering a rare window into capabilities the CIA traditionally guards more closely than almost anything else. The implication Ellis left on the table — one he did not state directly — is that U.S. cyber operations have crossed a threshold: they are no longer a separate technical service that supports traditional intelligence, but the decisive real-time targeting layer that makes a complex kinetic operation possible in the first place, and there is no existing legal or normative framework designed to govern that integration when it crosses into the sovereign territory of a foreign state. Ellis detailed this at Billington on September 8, 2026.

Operation Absolute Resolve: What Happened and What Made It Work

In the predawn hours of January 3, 2026, operators from the 1st Special Forces Operational Detachment-Delta and aviators from the 160th Special Operations Aviation Regiment — the elite "Night Stalkers" who flew the 2011 Abbottabad raid — executed a nighttime assault on Maduro's fortified compound at Fuerte Tiuna in Caracas, Venezuela. The air package totaled more than 150 aircraft , launching from 20 bases across the Western Hemisphere. By 3:29 a.m. ET, the force was back over water with Maduro and his wife, Cilia Flores, aboard the USS Iwo Jima. The pair were subsequently flown to New York to face longstanding narco-terrorism charges in the indictment originally filed in 2020.

Joint Chiefs Chairman Gen. Dan Caine had previously credited the CIA, the National Security Agency, and the National Geospatial-Intelligence Agency with supporting the mission, describing months of intelligence collection on Maduro's movements and daily routines. What he did not specify was the CIA's specific contribution. Ellis filled in that gap Tuesday.

"If you look at Absolute Resolve, you know that operation was only made possible by a flawless intelligence picture, and that flawless intelligence picture was built on cyber operations enabled by our CCI team," Ellis told the Billington audience. "Without that kind of operational picture, being driven by cyber, we wouldn't have been able to help enable U.S. Special Forces to identify the location of Nicolás Maduro and apprehend him within four minutes of landing on the ground."

How CIA Cyber Gained Mission Center Status — and Why That Mattered

The performance Ellis described was made possible, he argued, by a structural change that Director John Ratcliffe made in October 2025: elevating the CIA's Center for Cyber Intelligence from a subordinate unit within the Directorate of Digital Innovation to a full-fledged mission center — the same organizational tier occupied by the CIA's Counterterrorism and Counterproliferation operations. This elevation represented one of the most significant organizational changes to the agency's cyber division in years, following Ratcliffe's quiet CCI restructuring .

The Directorate of Digital Innovation had housed the CCI since 2015. Under that arrangement, CCI leadership did not report directly to the Director, and the unit had to compete internally for staffing and resources through the DDI chain. Mission center status changed both conditions immediately.

"That promotion allowed us to both focus priority on the cyber mission as well as to better align resources around that mission," Ellis said. Mission center status, he added, "smooths out reporting chains, helps us move more agilely, and helps us align the resources to make sure that we can bring cyber operations to bear to solve these tough intelligence problems."

A former Trump administration official, speaking anonymously to The Record when the elevation was first reported in April 2026, called the change a significant organizational upgrade: "It allows them to get some more money, allows them to be more of a player at the table."

The CIA also simultaneously folded the Biden-era Transnational and Technology Mission Center into other offices — a reorganization that effectively concentrated the agency's technology resources under the Cyber Mission Center's direct leadership, rather than distributing them across a parallel structure. The consolidation of CIA technology resources is part of a broader effort under Ratcliffe to focus the agency's technological capabilities.

What Cyber Contributed — and the Layer No One Has Fully Explained

Ellis did not disclose what systems the CIA's cyber operators targeted, what methods they used, or what specific intelligence the targeting picture contained. What he confirmed is that the picture was accurate enough, and current enough, to pinpoint Maduro's location within the minutes available for a ground force that was already descending.

Earlier reporting had placed the NSA in the role of geolocation support and signals monitoring , watching for any indication that Venezuelan forces had detected the inbound raid. Independent reporting in January 2026 by The New York Times and subsequently analyzed by Ars Technica described a U.S. cyber operation that briefly shut off most of Caracas's electricity in the minutes before the assault and simultaneously disrupted Venezuelan military radar, allowing U.S. helicopters to enter without detection. The power outage in neighborhoods close to Fuerte Tiuna lasted up to 36 hours.

That reported power operation involved U.S. Cyber Command, not the CIA, though both institutions were active in the theater. Cybersecurity researchers noting BGP routing anomalies at CANTV — Venezuela's state-owned telecommunications provider, operating under Autonomous System 8048 — flagged unusual AS-path prepending on Caracas infrastructure in the hours before the raid. Cloudflare analyzed the same data and attributed the anomalies to misconfiguration consistent with CANTV's documented prior behavior, though the timing drew significant scrutiny in the security community. Multiple security researchers analyzed whether the Caracas power disruption was cyber, kinetic, or a combination of both.

What Ellis confirmed — without specifying which layer he was describing — is that the intelligence picture the CIA's Cyber Mission Center provided was the decisive enabling factor in the four-minute location outcome. In an operation whose success depended on forces landing and reaching their target before any organized defense could respond, that picture was, in his telling, the difference between the mission and the absence of a mission.

Does Cyber Enabling Extraterritorial SOF Operations Have a Legal Framework?

Ellis's candor comes at a legally fraught moment. On September 2, Maduro's lead attorney Barry Pollack filed two motions in the Southern District of New York: a request to dismiss the entire indictment on sovereign immunity grounds (the doctrine known as ratione personae, which the International Court of Justice held in 2002 shields sitting heads of state from foreign criminal prosecution), and a separate motion to dismiss the narco-terrorism charge specifically on jurisdictional grounds. Pollack's immunity motions were filed September 2, 2026, and an evidentiary hearing is scheduled for November 17, with trial set for June 2027 if Pollack's arguments fail. Maduro's legal team detailed the immunity defense in court filings .

Legal analysts have noted that the immunity claim faces long odds. The U.S. ceased recognizing Maduro as Venezuela's legitimate president in 2019, weakening his claim to sitting-head-of-state immunity. And in 1990, the Eleventh Circuit rejected the immunity claim of former Panamanian dictator Manuel Noriega — though Noriega was already out of power when arrested following the U.S. invasion of Panama.

The more novel legal question that Ellis's remarks make vivid is one that neither his disclosure nor any existing framework directly answers: what body of law governs the use of offensive cyber operations by one state's intelligence agency to locate a foreign head of state in their own capital — as a targeting service for a military arrest operation? Traditional international law on cross-border law enforcement operations treats state jurisdiction as bounded by consent, and the policing of transnational crime across sovereign borders as requiring either consent or treaty authority. The Tallinn Manual 2.0, the most authoritative academic attempt to map international law onto cyber operations, does not directly address cyber intelligence as a targeting layer for kinetic extraterritorial law enforcement. That gap — not the capture itself — is what Ellis's disclosure places on the table for the first time.

What It Revealed the New CIA

Ellis's remarks were not limited to Venezuela. He also disclosed that the CIA had already produced what he described as the first intelligence report written entirely by a generative AI system, with no human analyst involved in the production pipeline. The agency ran more than 300 AI projects in 2025 , according to Ellis's earlier remarks in April. That first AI-generated CIA intelligence report represents what Ellis called a milestone for the agency's analytical pipeline.

"In cyber operations, it brings speed and scale that would be unimaginable without these AI tools," Ellis said of AI at Billington. The agency, he added, expects AI to "permeate how the CIA is doing this work and it will change every aspect of intelligence." Ellis elaborated on AI's CIA role during his Billington remarks on September 8.

Ellis stressed that the agency would maintain appropriate safeguards: a human in the intelligence loop, a deliberate effort to avoid dependence on any single AI model or vendor, and a workforce that has the "mindset and enthusiasm to embrace these AI tools." He also said the CIA is on track to meet all its fiscal year 2026 hiring goals, and that a more technically oriented CIA workforce — people for whom a STEM background "sure helps make things easier" — is where the agency wants its talent pipeline to head.

The accumulation of disclosures is itself significant. That the CIA's second-in-command chose the Billington Summit — a conference attended by thousands of government and industry cybersecurity professionals — as the venue for these admissions represents a deliberate posture shift under the current leadership. Prior CIA directors and deputies have, as a rule, said almost nothing specific agency cyber activities in public forums. The most extensive prior window into the CIA's cyber capabilities came not from an official but from the 2017 WikiLeaks "Vault 7" disclosures , which exposed the CCI's hacking tools without any agency authorization.

Ellis's willingness to name the Cyber Mission Center, to describe its operational role, and to project AI as the agency's central priority is something qualitatively different: a calculated disclosure to signal to adversaries that the investment is paying off, and to signal to the workforce and potential recruits that the agency is where the cutting edge of this competition is happening.

What Does "Cyber-Enabled Special Operations" Mean for Adversaries?

For foreign intelligence services watching the Billington Summit coverage, the operational lesson is blunt. A CIA Cyber Mission Center that can generate a real-time targeting picture precise enough for special forces to reach a known compound and locate a single individual within four minutes — in a capital city, at night, in the face of an integrated air defense — is a capability that changes the calculus for any head of state whose U.S. legal exposure is documented and whose location patterns can be mapped. Maduro was a named defendant in a federal indictment since 2020. His capture confirmed the reach of that indictment.

The disclosure also confirms what had been reported but not officially stated: that U.S. offensive cyber operations were not confined to network exploitation or intelligence collection during the Venezuela mission, but extended to shaping the operational environment — degrading defenses, disrupting communications, and providing the targeting data that made the four-minute outcome possible. In doctrine terms, what Ellis described is a multi-domain operation in which the CIA's cyber layer was not support but backbone.

The normative and legal implications of that doctrine are ones the intelligence and defense communities, allied governments, and international legal scholars will be working through long after Maduro's November hearing concludes. Ellis confirmed the capability. No one in Washington has yet offered the framework that governs it.

Frequently Asked Questions

How did the CIA's Cyber Mission Center help locate Maduro in four minutes?

CIA Deputy Director Michael Ellis said at the Billington CyberSecurity Summit on September 8, 2026, that the CIA's Cyber Mission Center built what he called a "flawless intelligence picture" that told U.S. Special Forces exactly where Maduro was when they landed at Fuerte Tiuna in Caracas. He did not disclose the specific methods, systems, or intelligence targets used. Separately reported elements of the broader intelligence architecture included NSA geolocation and signals monitoring, NGA geospatial mapping, a human intelligence source close to Maduro who provided day-of location information, and Cyber Command operations that reportedly disrupted Caracas's power grid and Venezuelan military radar before the assault. What Ellis specifically confirmed is that the CIA cyber component provided the targeting layer that made the four-minute outcome possible.

What changed when the CIA's Center for Cyber Intelligence became a full mission center?

Before October 2025, the Center for Cyber Intelligence reported through the CIA's Directorate of Digital Innovation — one of the agency's five major directorates. In that structure, CCI leadership did not have direct access to Director Ratcliffe, and the center competed for resources alongside other priorities within the DDI. When Ratcliffe elevated the CCI to mission center status, its leadership began reporting directly to the Director, it gained priority access to staffing and resources, and its reporting chains — in Ellis's words — became smoother and more agile. The practical result, Ellis argued at Billington, was the operational performance in Venezuela: the ability to build and deliver a targeting picture of the quality required by a live special operations mission.

Is there a legal framework governing CIA cyber operations that enabled the Maduro capture?

No comprehensive, publicly stated legal framework governs the specific combination of cyber-enabled targeting intelligence provided by a civilian intelligence agency in support of a kinetic extraterritorial special operations arrest. The DOJ Office of Legal Counsel issued a memo asserting the president has inherent constitutional authority to authorize extraterritorial arrests of indicted fugitives, which the administration used as the legal basis for Operation Absolute Resolve. Separately, a 2018 presidential finding gives the CIA broad authority for offensive cyber operations. But neither framework was designed for, or specifically addresses, the scenario Ellis described: the CIA's Cyber Mission Center generating a real-time targeting picture for special forces conducting an extraterritorial law enforcement operation in a foreign sovereign's capital. Maduro's attorneys are currently testing the outer edges of these questions in Manhattan federal court, with an evidentiary hearing scheduled for November 17, 2026.

How is AI already changing CIA intelligence operations?

Ellis disclosed at a Special Competitive Studies Project event in April 2026 that the CIA had produced the first intelligence report in its history written entirely by a generative AI system with no human analyst involvement. The CIA ran more than 300 AI projects in 2025. Ellis said the agency plans to embed AI "coworkers" in all analyst platforms within two years, with AI handling tasks like drafting key judgments, editing for clarity, and checking against tradecraft standards — while human analysts retain decision authority. On a longer timeline, Ellis said the CIA envisions AI tools as "autonomous mission partners" with officers managing teams of AI agents. At Billington, he stressed cyber operations specifically: AI, he said, brings "speed and scale that would be unimaginable without these AI tools" in that domain. The agency is also using AI-generated open-source intelligence reports distributed to local police through DHS fusion centers, raising questions mission scope that Ellis did not directly address at the Summit.