Daily intelligence briefing: 21 August 2026

London waits on a count and Monaco closes its roads. The Arriva ballot on the company’s offer has closed and the result is expected today; if members reject it the next strike block begins on Tuesday the 25th, the same day the Piccadilly line’s second midweek closure starts, so next week’s movement plans should already carry both contingencies. In the Gulf the squeeze is now openly financial: the US Treasury has sanctioned a Hezbollah cash courier network spanning Lebanon, Turkey, the UAE and Iran, Secretary Bessent has called a Monday press conference to detail what he calls the toughest sanctions in history, war risk insurance has reached roughly forty times pre crisis levels and Brent sits above 93 dollars, on track for a second weekly gain. Monaco’s Vuelta closures begin this morning with Boulevard Albert Ier shut until 14:00, New York’s storms have cleared, and our travel test for the Gulf remains unmet: all Gulf travel, including Dubai, stays deferred.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The overnight picture is quiet in published terms: the Metropolitan Police newsroom’s only overnight addition is a sentencing, two attackers jailed after officers found a suspect hiding under a bed, and no new major incident had been declared in the capital as of this morning. The standing casework is unchanged: the murder investigation into the deliberately set fire on Berkeley Avenue in Hounslow continues with no arrests yet announced, the charge in the Shepherd’s Bush killing of Samantha Turner stands, and the Newham shooting investigation and the Clapham appeal in the killing of Auguste-Marie Bile both remain open. A quiet night does not change the August advice: with families still away in peak season the domestic perimeter, including fire and smoke detection alongside intrusion, should be treated as live rather than theoretical until the school term resumes.

Movement hangs on the ballot. Voting on Arriva’s offer has closed and the result is expected today; the suspension of action holds meanwhile, with the more than 40 affected routes across north and east London, including the 29, 34, 141 and 149 and the night services, running normally. If members reject the offer the next strike block runs from Tuesday the 25th to Friday the 28th, with further dates pencilled through September and into October, and Tuesday is also the day the Piccadilly line’s second midweek closure begins between Cockfosters and Uxbridge, running to Thursday the 27th, so next week’s plans should carry both contingencies together. Wembley remains dark until the AEW All In event on the 30th, and the next crowd fixture of consequence is Notting Hill Carnival next weekend: the ticketed Panorama competition on Saturday the 29th, J’Ouvert from sunrise on Sunday the 30th and the main parade on Monday the 31st, with some two million attendees expected, stations liable to close on crowding and TfL’s travel notices already live. The weather is benign: sunny intervals and about 21 degrees, a 30 per cent chance of a mid afternoon shower, gusts near 23 mph, and no Met Office warnings or UKHSA alerts in force.

Travel corridors

Hormuz enters day 173 with the economic squeeze tightening ahead of Monday’s detail. The US Treasury has sanctioned ten individuals accused of moving hundreds of millions of dollars to Hezbollah through a cash courier network spanning Lebanon, Turkey, the UAE and Iran, and Secretary Bessent, promising the toughest sanctions in history and speaking openly of collapsing the regime, has called a press conference for Monday to set out the coordinated isolation measures behind last week’s secondary sanctions announcement; Tehran’s foreign ministry calls the programme economic terrorism. Enforcement continues at sea: CENTCOM reports 67 commercial vessels redirected and three disabled under the blockade, American officials say between 15 and 20 tankers now move each night through the controlled corridor along the Omani coast, carrying close to ten million barrels a day, about half the pre war flow, with more than 80 per cent of tracked vessels hugging that shoreline under fighter cover, and US forces shot down eight Iranian drones and two cruise missiles earlier in the week; nine vessels transited with transponders active on Wednesday. Iran disputes the corridor’s legality, claims to have turned back a Chinese tanker and continues to hold a detained UAE vessel, and the risk picture now extends beyond the strait itself: a US sanctioned product tanker was hijacked in the Gulf of Aden on Thursday and redirected towards Somalia after six armed men boarded. War risk premiums have reached roughly forty times pre crisis levels, at about ten million dollars for a single VLCC voyage, six P&I clubs have withdrawn cover altogether, and Brent trades at about 93.46 dollars this morning, up more than 5 per cent on the week and some 38 per cent on the year, with markets pricing a reopening by month end at under one per cent.

The carrier ladder’s bellwether decision is due today. Air France’s pencilled return to Riyadh falls this morning and no announcement had been published as we compiled; a week that has brought a hijacking in the approaches, a deepening sanctions regime and a rupture between the UAE and Iran is not one in which resumption cases strengthen, and an extension remains our base case, with Dubai and Beirut pencilled for the 25th behind it. The rest of the ladder is unchanged on paper: Emirates operates its single daily Dubai to Bahrain rotation with Kuwait still suspended, KLM remains away from Riyadh, Dammam and Dubai until 6 September, British Airways from Dubai, Tel Aviv, Bahrain and Amman until 25 October, Lufthansa and SWISS from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Finnair until 24 October, Cathay Pacific until the 25th and 26th of October, United until 7 September, Air Astana until the end of August and Air Canada to the middle of January 2027. Specific flights should be confirmed before any movement is built around them.

Monaco’s closures begin this morning: Boulevard Albert Ier is shut from 06:00 to 14:00 today for the finish line build, closes again from 08:00 tomorrow, and the full 9.6 kilometre time trial circuit, from Place du Casino through the Moulins district, the Fairmont hairpin, Larvotto, Port Hercule and Fontvieille to the Grand Prix start finish straight, closes to all traffic from midday tomorrow, with racing from 16:00 to about 19:30 and progressive reopening from around 21:00. Sunday’s Stage 2 leaves Place du Palais Princier with the official start at noon, CAM buses run free from today through Sunday on diverted routes, and anything that must move in or out of the Principality by road should complete this morning or wait for Monday. Paris is in the final weekend of its eastern engineering block: the RER A closure between Vincennes and Noisy le Grand runs through Sunday, the RER D remains interrupted between Gare du Nord and Gare de Lyon, trams T1 and T2 and Nation station stay closed until the 30th, and metro lines 1, 2, 6 and 9 remain the workaround. Geneva recorded no overnight development; the burglary reporting that put numbers on the corridor’s standing frame continues to circulate internationally and the guidance is unchanged. Zurich’s constraint remains the SWISS suspension from Dubai. New York’s storm system delivered what was forecast, with tornadoes and widespread flash flooding across the Mid Atlantic on Thursday, but the city’s advisory expired overnight, no alert is in force for Friday and the airports are operating normally.

Digital and privacy exposure

Both standing cases hold their shape. Coldcard’s guidance is unchanged: seeds generated on affected firmware between March 2021 and the patch remain compromised regardless of the firmware now installed, public tallies of the stolen funds have continued to climb through the week, and every unsolicited approach concerning recovery should be treated as hostile. On UNC6671, Google’s fuller accounting this month sharpens the picture rather than changing it: the group retired its BlackFile brand in May and now runs extortion under at least four names, Redact, Pink, Helix and Falcon, its operators call employees on their personal phones posing as IT help desks, harvest credentials and MFA tokens through adversary in the middle pages, and steal from Microsoft 365 and Okta estates before demanding payment, and since July its targeting has settled on financial and legal firms, squarely the professional layer that surrounds a family office. The controls that defeated it are unchanged: phishing resistant authentication actually enforced, single sign on with session controls, access restricted to managed devices, and callback verification through known channels for every credential and payment instruction.

The week’s escalation has a cyber dimension that will outlast the shipping story. US financial regulators and FINRA maintain heightened threat warnings around Iranian state aligned actors, Iranian military spokesmen have publicly named US and Israeli linked financial institutions as targets, and CISA’s standing advisory on Iranian exploitation of industrial control systems remains in force; a sanctions programme designed, in the Treasury’s words, to collapse the regime invites retaliation in the domain where Tehran can reach furthest at least cost. For principals and their offices the implications are practical rather than dramatic: out of band verification for payment instructions, offline copies of critical records, and continuity arrangements that do not depend on a single bank, communications channel or cloud tenant. The Geneva lesson also keeps its force into a Carnival and holiday weekend: police there state plainly that burglary gangs research their targets on social media before they travel, so real time posting from family, staff and guest accounts remains the cheapest exposure to close.