Daily intelligence briefing: 23 August 2026

Monaco hands its roads back tonight and London’s hinge is now 48 hours out. The Arriva ballot result remained unpublished as we compiled, so Tuesday still carries doubled friction: the four day strike block across more than 40 north and east London routes if members have rejected the offer, and the Piccadilly line’s second midweek closure between Cockfosters and Uxbridge, both beginning on the 25th. In the Gulf the weekend has hardened into a split screen. President Pezeshkian’s call to end the war from a position of power and dignity now sits against his own military chief’s promise of crushing, punishing and devastating responses, and Secretary Bessent details the secondary sanctions programme tomorrow. Brent closed the week near 94 dollars, up some 39 per cent on the year. In the Principality the Vuelta’s Stage 2 rolls out from Place du Palais Princier around midday, with the official start at the Exotic Garden before the race leaves for Manosque; roads reopen progressively once the caravan clears and normal movement resumes tomorrow. Our travel test for the Gulf remains unmet: all Gulf travel, including Dubai, stays deferred.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The Metropolitan Police newsroom’s latest entries are Friday afternoon’s: an investigation is underway after a 52 year old man died in police custody in Croydon, a murder investigation has been opened after bones found in Feltham were identified as human remains, and the gang caught attempting to tunnel into a south London jewellery shop, part of a series of break ins totalling more than 700,000 pounds, has pleaded guilty. Nothing new was published overnight and no major incident had been declared in the capital as of this morning. The standing casework is otherwise unchanged, and the tunnelling case is worth a moment’s reflection beyond its novelty: patient, researched, infrastructure level attacks on high value premises are a live method in this city, not a period drama. The August advice holds through the final week of peak season: with families still away the domestic perimeter, including fire and smoke detection alongside intrusion, should be treated as live rather than theoretical until the school term resumes.

Movement still hangs on the unpublished ballot. Voting on Arriva’s offer closed on Friday, no result had been communicated as we compiled, and the suspension of action holds meanwhile, with the affected routes running normally this weekend. The planning position is therefore unchanged: if the offer has been rejected the next strike block runs from Tuesday the 25th to Friday the 28th, Tuesday is also the first day of the Piccadilly line’s second midweek closure between Cockfosters and Uxbridge, running to Thursday the 27th, and both contingencies belong in this week’s plans until the result lands. Today’s constraint is engineering: the District line is severed in the west all day, with no eastbound service between Stamford Brook and Barons Court, no westbound service between Earl’s Court and Stamford Brook, and no service to Kensington Olympia or between Fulham Broadway and Wimbledon, the Elizabeth line starts late between West Drayton and Maidenhead, the Windrush line is closed all day between New Cross Gate and Crystal Palace and West Croydon, and eastbound Piccadilly trains miss Caledonian Road; note that Barons Court remains inaccessible to westbound District and Piccadilly trains into November. The next crowd fixture is Notting Hill Carnival next weekend, the ticketed Panorama competition on Saturday the 29th, J’Ouvert from sunrise on Sunday the 30th and the main parade on Monday the 31st, with some two million attendees expected, stations liable to close on crowding, and this year’s pre event debate about stewarding and funding still unresolved in public. The weather is benign: warm and largely dry today with no Met Office warnings in force for London.

Travel corridors

Hormuz enters day 175 as a split screen. President Pezeshkian’s Saturday call to end the war while Iran holds a position of power and dignity was answered within a day by armed forces chief Abdollahi’s pledge of crushing, punishing and devastating responses to any miscalculation, and by a deputy defence minister’s claim that weapons production has increased through the war. The quieter signals point the other way: Tehran has permitted Iraqi crude tankers protected passage through the strait, its first concrete concession since the ceasefire collapsed, and the Omani and Iranian foreign ministers have discussed resuming negotiations over strait navigation, the same channel that produced the Islamabad memorandum. Conditions at sea remain severe: Royal Navy derived data puts weekly transits at roughly 4 per cent of pre war levels, 67 commercial ships remain blocked from Iranian ports under the US blockade, war risk premiums run at 7.5 to 10 per cent of hull value against a quarter of one per cent before the war, and the US Navy reports escorting more than 15 million barrels through the strait on a single day. Brent finished the week at about 94.39 dollars, up some 39 per cent on the year, and tomorrow’s Treasury press conference, with Chinese compliance its declared focus, is the week’s defining event.

The carrier ladder faces its next test within 48 hours. Air France’s Dubai and Beirut resumptions remain pencilled for the 25th with no announcement either way, and after a week containing a fatal strike on a merchant vessel and the UAE’s rupture with Tehran the base case remains a further extension. The rest of the ladder is unchanged on paper: Emirates operates its single daily Dubai to Bahrain rotation with Kuwait still suspended, KLM remains away from Riyadh, Dammam and Dubai until 6 September, British Airways from Dubai, Tel Aviv, Bahrain and Amman until 25 October, Lufthansa and SWISS from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Finnair until 24 October, Cathay Pacific until the 25th and 26th of October, United until 7 September, Air Astana until the end of August and Air Canada to the middle of January 2027. Specific flights should be confirmed before any movement is built around them.

Monaco completes its handover today. Stage 2 rolls out ceremonially from Place du Palais Princier around midday with the official start at the Exotic Garden before the race heads for Manosque, closures along the departure route lift progressively once the caravan clears, CAM buses run free on diverted routes for a final day, and anything that must move in or out of the Principality by road should still wait for tomorrow. Paris ends its eastern engineering block tonight: this is the final day of the RER A closure between Vincennes and Noisy le Grand, with service due back tomorrow, while the RER D remains interrupted between Gare du Nord and Gare de Lyon and trams T1 and T2 and Nation station stay closed until the 30th. Geneva recorded no overnight development; the burglary series against prominent residences remains the standing concern and the guidance on residential security and social media discipline is unchanged. Zurich’s constraint remains the SWISS suspension from Dubai. New York is clear: the airports are operating normally after Thursday’s storm ground stops, and the airline rebooking waivers issued in their wake expire today.

Digital and privacy exposure

Both standing cases hold their shape. The Coldcard tally stands at between 112 and 116 million dollars, roughly 1,778 Bitcoin drained across more than 4,500 affected addresses, and the guidance is unchanged: seeds generated on affected firmware between March 2021 and the patch remain compromised regardless of the firmware now installed, funds should be moved from any potentially affected wallet via a clean device, and every unsolicited approach concerning recovery should be treated as hostile. On UNC6671 the picture consolidates: the group runs extortion under at least four brands, Redact, Pink, Helix and Falcon, its operators call employees on their personal phones posing as IT help desks, harvest credentials and MFA tokens through adversary in the middle pages, and steal from Microsoft 365 and Okta estates before demanding payment, with hedge funds and private equity firms now confirmed among recent victims alongside the legal sector. It is the same professional layer that ShinyHunters worked earlier this year, when 641,000 records were claimed from a single family office advisory firm: the advisers, lawyers and managers around a family hold the family’s data, and attackers have noticed. The controls are unchanged: phishing resistant authentication actually enforced, single sign on with session controls, access restricted to managed devices, and callback verification through known channels for every credential and payment instruction.

Tomorrow’s designations sharpen the cyber question. US financial regulators and FINRA maintain heightened warnings around Iranian state aligned actors, CISA’s standing advisory on Iranian exploitation of industrial control systems remains in force, and a sanctions programme designed to sever Iran from the financial system invites retaliation in the domain where Tehran can reach furthest at least cost; the weekend’s split screen makes that more likely, not less, since cyber operations are precisely the instrument a state reaches for when it wants pressure without escalation. For principals and their offices the implications remain practical: out of band verification for payment instructions, offline copies of critical records, and continuity arrangements that do not depend on a single bank, communications channel or cloud tenant. The social media lesson keeps its force into the last week of the holiday season and Carnival weekend: burglary gangs research their targets online before they travel, so real time posting from family, staff and guest accounts remains the cheapest exposure to close.