Daily intelligence briefing: 25 August 2026

The week begins with both London constraints confirmed. More than 1,500 Arriva drivers are on strike from this morning across more than 40 north and east London routes, running to Friday, and the Piccadilly line is closed between Cockfosters and Uxbridge until Thursday. In Washington the waiting ended at 7pm London time last night: Secretary Bessent unveiled Operation Economic Outcast, designating nearly 60 entities and individuals across networks in the UAE, Hong Kong, China, Singapore, Switzerland and Europe, yet declining to put a timetable on secondary sanctions against Chinese banks, and markets read the restraint, with Brent easing below 92 dollars this morning even as Tehran promised a seismic response and the rial collapsed through 2 million to the dollar. Monaco, barely reopened after the Vuelta, now carries rotating morning road closures for the Ocean’s film shoot until Friday, taking in Casino Square on Thursday. Our travel test for the Gulf remains unmet: all Gulf travel, including Dubai, stays deferred.

United Kingdom and London

The national terrorism threat level remains at SEVERE, meaning an attack is highly likely. The public record over the past day is routine rather than alarming: the Metropolitan Police newsroom’s latest entries record a man charged with murder following the fatal shooting in Newham and an arrest after the fatal fire in Hounslow on 19 August, alongside the standing investigations into the death in custody in Croydon and the human remains found in Feltham, while the guilty pleas from the tunnelling gang caught beneath south London remain the season’s clearest lesson on patient, researched attacks against high value premises. No major incident had been declared in the capital as of this morning. The seasonal advice is now in its final days: with many families away until the school term resumes next week, the domestic perimeter, including fire and smoke detection alongside intrusion, should be treated as live rather than theoretical.

Movement friction has arrived on schedule. The Arriva strike began this morning and runs to Friday the 28th, involving more than 1,500 drivers from the Barking, Edmonton, Enfield, Grays, Palmers Green, Stamford Hill, Tottenham and Wood Green garages and more than 40 routes across north and east London, with further blocks announced for the 4th and 5th, 7th and 8th, 18th and 19th, and 21st and 22nd of September. The Piccadilly line is closed between Cockfosters and Uxbridge until Thursday the 27th, with the Metropolitan line operating normally between Rayners Lane and Uxbridge, and Barons Court remains inaccessible to westbound District and Piccadilly trains into November. Attention then turns to Notting Hill Carnival: the ticketed Panorama competition on Saturday the 29th, J’Ouvert from sunrise on Sunday the 30th and the main parade on bank holiday Monday the 31st, with some two million attendees expected, a very significant policing presence promised, stations liable to close on crowding and the stewarding and funding debate still unresolved. The weather will not help: today is warm and largely fine at around 26 degrees, but thundery showers arrive from the early hours of Thursday, Friday looks wet, and showers are likely through Carnival weekend itself; no Met Office warnings were in force for London as we compiled.

Travel corridors

Hormuz enters day 177 with the economic weapon unsheathed, though not fully swung. Secretary Bessent’s announcement last night, styled Operation Economic Outcast, designates nearly 60 entities and individuals, the brokers, front companies and shadow fleet vessels moving Iranian oil and channelling revenue to the Revolutionary Guard, across networks in the UAE, Hong Kong, China, Singapore, Switzerland and Europe, and suspends academic, sporting and remittance channels besides. What it withholds matters as much: there is no timetable for secondary sanctions on Chinese institutions, with Bessent saying only that no one is above the reach of US sanctions and that everyone is being given the opportunity to remedy bad behaviour. Beijing, which buys some 90 per cent of Iran’s exported oil, dismissed the measures as lacking any basis in international law, and India’s compliance is widely identified as the swing factor. Tehran’s response was rhetorical and financial at once: security chief Mohsen Rezaei promised retaliation in a seismic manner and repeated the threat to close the strait to its neighbours’ oil, while the rial fell through 2 million to the dollar, a record low, with inflation running near 90 per cent. Conditions at sea are unchanged and severe: a handful of very large crude carriers transit daily against eight before the war, traffic hugs the Omani side of the strait, and war risk premiums sit at multiples of their pre war level. Brent eased to around 91.90 dollars this morning, down a further third of one per cent, as markets judged the package more restrained than billed; gold sits at its highest since May.

The carrier ladder’s test date has arrived without an answer. Air France’s Dubai and Beirut suspensions were stated to run until today, the 25th, and no resumption had been announced as we compiled; after a month of rolling extensions and last night’s designations, a further extension remains the base case, with the airline maintaining that resumption depends on its assessment of a rapidly evolving security situation. The rest of the ladder is unchanged on paper: Emirates operates its single daily Dubai to Bahrain rotation with Kuwait still suspended, KLM remains away from Riyadh, Dammam and Dubai until 6 September, British Airways from Dubai, Tel Aviv, Bahrain and Amman until 25 October with Jeddah dropped permanently and Doha and Riyadh cut to one daily flight each, Lufthansa and SWISS from Dubai until 13 September, which continues to bear on the Zurich corridor, Singapore Airlines and Finnair until 24 October with Finnair’s Doha suspension now running through the winter season, Cathay Pacific until the 25th and 26th of October, Aegean and Air Astana to the end of this month, Wizz Air to mid September and Air Canada to the middle of January 2027. Specific flights should be confirmed before any movement is built around them.

Monaco’s reopening lasted a weekend. Filming for the Ocean’s prequel began yesterday and runs to Friday the 28th, with rotating road closures between 5am and 10am each morning: Port Hercule yesterday, the central axis including Boulevard Albert Ier, the Sainte Devote roundabout and the Rocher tunnel today, the Avenue des Citronniers and Avenue Princesse Grace sector on Wednesday, Casino Square with Avenue d’Ostende and Avenue de Monte-Carlo on Thursday, and the Portier roundabout and Larvotto slip road on Friday. Bus lines 6 and X3 do not operate before 10am, stops across lines 1 to 5 are suspended and parking bans begin at 3am, so morning movements should be planned around the schedule or held until after 10am. Paris continues its recovery: the RER A reopened between Vincennes and Noisy le Grand yesterday, though Nation station on the line remains closed to the 30th, tram T1 stays suspended between Asnieres Quatre Routes and Gare de Saint Denis, and residual works elsewhere on the network run into early September. Geneva recorded no overnight development; the burglary series against prominent lakeside residences remains the standing concern, and the guidance on residential security and social media discipline is unchanged. Zurich’s constraint remains the SWISS suspension from Dubai. New York is operating, but August has been unkind: thunderstorms and chronic air traffic control understaffing have produced repeated ground delay programmes at JFK, LaGuardia and Newark this month, with average delays at times exceeding two hours and more than 900 cancellations across the three airports, so afternoon departures should carry generous margins.

Digital and privacy exposure

Both standing cases have grown at the edges without changing shape. TRM Labs’ updated accounting of the Coldcard exploit now puts the theft at around 116 million dollars, roughly 1,816 Bitcoin drained from more than 5,200 affected addresses, figures it describes as preliminary while tracing continues, and the guidance is unchanged: seeds generated on affected firmware from March 2021 until the patch remain compromised regardless of the firmware now installed, funds should be moved via a clean device with a small test transaction first, and every unsolicited approach concerning recovery should be treated as hostile. UNC6671 likewise: Google’s threat intelligence team confirms the group, built around former BlackFile affiliates, runs extortion under at least four brands, Redact, Pink, Helix and Falcon, calls employees on their personal phones posing as IT help desks, harvests credentials and MFA tokens through adversary in the middle pages and steals from Microsoft 365 and Okta estates, with hedge funds and private equity firms among confirmed victims and individual ransoms reported in the millions. The lesson for family offices holds: the advisers, lawyers and managers around a family hold the family’s data, and attackers have noticed. The controls are the same ones we have listed before: phishing resistant authentication actually enforced, single sign on with session controls, access restricted to managed devices, and callback verification through known channels for every credential and payment instruction.

The cyber question now has its trigger event behind it. Last night’s designations are precisely the kind of financial squeeze to which Tehran’s cheapest far reaching answer lies in cyberspace, and the promise of a seismic response should be read partly in that domain; FINRA’s heightened alert to the financial sector and the updated CISA advisory on Iranian exploitation of industrial control systems both remain in force. For principals and their offices the implications remain practical rather than dramatic: out of band verification for payment instructions, offline copies of critical records, and continuity arrangements that do not depend on a single bank, communications channel or cloud tenant. The social media lesson peaks this week: Carnival weekend and the final days of the holiday season are precisely when burglary gangs harvest real time location signals, so posting discipline from family, staff and guest accounts remains the cheapest exposure to close.