Daily intelligence briefing: 19 August 2026

London wakes to an unexpected reprieve. Unite suspended the second Arriva strike block from the early hours of this morning so that members can vote on a new offer from the company, returning more than 40 routes across north London to service through Friday, though the Piccadilly line remains closed between Cockfosters and Uxbridge until tomorrow and The Weeknd plays his final Wembley Stadium night tonight. The Gulf supplies the day’s gravity. Iran fired two ballistic missiles toward the United Arab Emirates on Tuesday evening, putting alert messages on phones in Dubai and Sharjah for the first time since 12 July, and a crew member was killed when a bulk carrier was struck by a projectile in the strait. Washington answered with a map: the President posted a graphic labelling the Strait of Hormuz new American territory, said no talks are under way, and the Treasury’s promised economic isolation package is still expected this week. Brent has climbed toward 92 dollars in a fourth consecutive session of gains. New York is fine and dry today ahead of afternoon storms tomorrow, and on the digital side the published economics of the UNC6671 campaign explain better than any warning why it will persist. Our travel test for the Gulf remains unmet, and all Gulf travel, including Dubai, remains deferred.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The overnight Metropolitan Police picture is heavier than Monday’s: detectives have launched a murder investigation after a woman died following a stabbing in Shepherd’s Bush, with a man arrested at the scene, and a separate murder investigation is under way following a fatal shooting in Newham. The renewed appeal in the Clapham shooting of 25 year old Auguste-Marie Bile remains open, as does the appeal following the death of a woman after a burglary at her home in Finsbury Park, and a jury yesterday convicted a man of murdering his 63 year old flatmate in Walthamstow. The Finsbury Park case continues to anchor our August advice: with families still away in peak season, the domestic perimeter should be treated as live rather than theoretical until the school term resumes, and two fresh murder investigations inside 24 hours are a reminder that the capital’s violent crime picture does not pause for the holidays.

Movement is transformed from yesterday’s forecast. Unite halted the strike block that was due to run until Friday, suspending action from about 04:00 this morning so that its more than 1,500 members across the Barking, Edmonton, Enfield, Grays, Palmers Green, Stamford Hill, Tottenham and Wood Green garages can vote on a new offer from Arriva, and the 43 affected routes, including the SL1 and SL2 Superloop services and the N19, N29, N41 and N279 night buses, return to service today. The reprieve is conditional: if the offer is rejected, action resumes with the third block from the 25th to the 28th, and further dates are pencilled through September and October. The Piccadilly line remains closed between Cockfosters and Uxbridge until tomorrow for the new train programme, with the Metropolitan line running normally between Rayners Lane and Uxbridge. The Weeknd plays his fifth and final Wembley Stadium night tonight, doors at 17:00 and out by around 22:30, so anything routed near Wembley this evening should still carry generous margins. The weather is benign: sunny intervals and about 24 degrees after a chance of early rain, with no Met Office warnings and no UKHSA heat alerts in force.

Travel corridors

Hormuz enters day 171 with the brinkmanship now kinetic. Iran launched two ballistic missiles toward the United Arab Emirates on Tuesday evening, one falling outside territorial waters and one within them according to the UAE Ministry of Defence, and residents of Dubai and Sharjah received missile alert messages, the first since 12 July, before an all clear followed; Tehran called the accusation baseless. In the strait itself the Liberia flagged bulk carrier Minoan Dignity was struck by an unknown projectile while transiting outbound, killing her chief engineer and damaging the engine room, with the Omani coastguard assisting the remaining crew. The political track hardened in parallel: the President posted a map labelling the strait new United States territory, a graphic Iran’s deputy foreign minister dismissed as a delusion that would be corrected, the White House position is that no talks or conversations are under way or scheduled, and parliament speaker Ghalibaf repeated that the strait stays closed until the blockade is lifted, frozen assets are released and military operations end. The Treasury’s unprecedented economic isolation package, trailed by Secretary Bessent, is still expected this week. The commercial picture remains dire: analysts now count crossings in single digits a day against a pre crisis norm above 130, hundreds of vessels continue to hold off Gulf berths, and Brent has climbed toward 92 dollars, about 91.40 this morning, in a fourth consecutive session of gains.

The carrier ladder is unchanged on paper and the doubt has sharpened. Air France remains due back into Riyadh on Friday the 21st, with Dubai and Beirut pencilled for the 25th, and a night on which Iranian missiles drew alerts across Dubai and Sharjah is precisely the development that produces a quiet extension notice; the airline’s stated position remains that resumption is subject to continuous assessment of the security situation. Otherwise the picture holds: Emirates operates its restored single daily Dubai to Bahrain rotation with Kuwait still suspended, Turkish Airlines is flying Abu Dhabi, Dubai, Damascus, Beirut and Amman with Iran routes off, KLM remains away from Riyadh, Dammam and Dubai until 6 September, British Airways from Dubai, Tel Aviv, Bahrain and Amman until 25 October with Jeddah dropped permanently, Lufthansa and SWISS from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Finnair until 24 October, Cathay Pacific until the 25th and 26th of October, United until 7 September, Air Astana until the end of August and Air Canada to the middle of January 2027. Specific flights should be confirmed before any movement is built around them, and the Air France Riyadh decision, now due within 48 hours, remains the week’s clearest bellwether of carrier confidence; after last night, an extension should be treated as the base case.

Paris holds its improved shape: the RER A remains closed between Vincennes and Noisy le Grand until Sunday the 23rd with replacement buses serving the closed stations, the RER D remains interrupted between Gare du Nord and Gare de Lyon, trams T1 and T2 remain interrupted, T2 until the 23rd, and Nation station stays closed for renovation until the 30th, with metro lines 1, 2, 6 and 9 the workaround. Monaco’s Vuelta week begins tomorrow: the team presentation on Thursday the 20th opens the programme and the first closures, Stage 1’s individual time trial runs entirely within the Principality on Saturday the 22nd, from Place du Casino past the Fairmont hairpin, along Larvotto and Port Hercule and through Fontvieille to a finish on Boulevard Albert Ier, and Sunday’s ceremonial start leaves from Place du Palais Princier, with bus diversions from Thursday and CAM services free on both race days. Anything that must move in or out of the Principality by road should do so today; from tomorrow, movements should be planned around the circuit. Geneva is quiet, with the cantonal property crime figures still the standing frame, and Zurich’s real constraint remains the SWISS suspension from Dubai. New York is sunny at about 30 degrees today with a light westerly breeze and no advisories in force, showers and possibly a thunderstorm are likely after 14:00 tomorrow, and all three airports are operating normally.

Digital and privacy exposure

The Coldcard picture consolidates without resolving. TRM Labs’ published analysis puts the theft at about 1,816 Bitcoin, some 116 million dollars, drained from more than 5,200 addresses in four waves from 30 July, with the first wave alone moving roughly 594 Bitcoin in 25 minutes, and confirms that laundering activity remains limited, with the bulk of victim funds still pooled at a small number of attacker controlled addresses under continuous public monitoring and attacker addresses circulated to exchanges and law enforcement. Nothing in the overnight reporting changes the guidance. Any seed generated on affected firmware between March 2021 and the patch should be treated as compromised regardless of the firmware now installed, assets should already have moved to a fresh seed generated on patched hardware with a verified fingerprint and a test transaction before full migration, and multisignature configurations were untouched throughout, which remains the strongest available argument for multisig custody of any material holding. A quiet phase in a theft of this scale is when recovery fraud does its work: every unsolicited approach concerning these funds, by any channel, should be treated as hostile.

On UNC6671, the published economics now explain the persistence. Reporting from Google Threat Intelligence Group consolidated this month shows the group, operating since its BlackFile retirement through the Redact, Pink, Helix and Falcon identities, took more than 10 million dollars in Bitcoin across 18 wallets between January and May, opening with demands of one to three million dollars and settling at an average of about 750,000 dollars in over half of tracked cases, and its passkey re enrolment lure has been run against Point72, Millennium, Two Sigma and Citadel, with Point72 detecting and containing its intrusion and Two Sigma stopping the attack at the portal stage. A morning like this one, when inboxes and phones carry genuine overnight notices about suspended strikes and changed services, is exactly the environment in which a call from a spoofed helpdesk number citing an urgent security requirement lands well. The defences remain structural: phishing resistant authentication genuinely enforced, callback verification through known channels for every credential, code and payment instruction, and access restricted to managed devices. Firms with institutional security teams blocked these attacks at the door; family offices without them should assume they present a considerably softer surface to the same operators, and with families still abroad in peak burglary month the standing rule against real time holiday posting from any family account continues to apply.