Daily intelligence briefing: 4 October 2026

The week ends in charge sheets rather than arrests: two Iranian nationals appeared before Westminster Magistrates’ Court yesterday accused of preparing an attack on Manchester’s Jewish community before Yom Kippur, a plot police say was directed by a third party who may be in Iran, and one they are careful to keep separate from the Fairford inquiry, whose Westminster arrestee has been released on bail. Tehran continues to study Washington’s written answer, with no rejection and no new talks announced, while the fullest account yet of the attempted downing of a Dubai to Tel Aviv flight has given the Gulf corridor an insider threat lesson. In Italy, a ninety five million euro fraud built on a cloned voice closes the week with the verification rule we have repeated all month.

United Kingdom and London

The national terrorism threat level remains at SEVERE. The most consequential development of the weekend is prosecutorial: two Iranian nationals, aged thirty four and thirty six, arrested in Manchester on 20 September, have been charged with preparing acts of terrorism and appeared before Westminster Magistrates’ Court yesterday, with a hearing at the Central Criminal Court listed for 23 October. The allegation is that the men sought components for an improvised explosive device and carried out surveillance of potential targets associated with Manchester’s Jewish community in the days before Yom Kippur, and investigators say they were in contact with a third party overseas who may be in Iran. Counter Terrorism Policing has been explicit that this case is not connected to the Fairford investigation, and the discipline of that separation is worth keeping: two strands may share a sponsor without sharing a network. On Fairford itself, the man arrested in Westminster has been released on bail, joining the five arrested at the fence line, all under stringent conditions, and no one has yet been charged; the government’s language on foreign state involvement has meanwhile hardened, with the Prime Minister speaking of strong indications of Iranian involvement, which Tehran dismisses as false. Our guidance holds on both fronts: American affiliated addresses should continue to assume sustained elevated attention, and principals with visible connections to Jewish community institutions, in London as in Manchester, should treat protective screening as a live rather than an annual matter, noting that charges within a fortnight of arrest usually indicate evidence rather than suspicion. The capital itself is quiet and unseasonably kind: around twenty three degrees, dry and sunny into the start of the week.

Travel corridors

Tehran is still reading. Four days after Doha delivered Washington’s written response, there has been no rejection, no acceptance and no announcement of further direct talks, and the most useful reporting of the week describes the true state of the file: the sides largely agree on the steps required and disagree on the order in which to take them, with Iran’s standing offer to reopen the strait within seven days of the lifting of the port blockade still on the table. Washington has meanwhile completed its withdrawal from Iraq, removing a set of targets and a point of leverage in the same motion, and briefing about renewed operations after the November elections continues to serve as the pressure behind the paper. On the water the war continues regardless of the diplomacy: a Kuwaiti flagged tanker was struck on 1 October with her crew rescued, a further vessel was reported hit on Friday, war risk cover is running at around forty times normal rates, roughly ten million dollars for a single supertanker voyage, and Brent has eased back to around a hundred and two dollars, which is softening at the margin rather than relief. We would add a note of caution on figures: published estimates of throughput in the strait now diverge so widely that we treat all of them with reserve, and the only safe planning assumption is that it remains closed to ordinary commercial movement. The corridor judgement is unchanged by any of it: no Gulf movement should be planned, the Dubai corridor stays deferred, and the American mission’s caution alert for the Emirates of 19 September stands, now alongside a formal advisory to reconsider travel to the Gulf.

The week’s sharpest operational lesson, however, came out of Dubai rather than the strait. The fullest account yet published of flydubai flight 1073 confirms that on 30 September the aircraft’s co pilot attacked the captain in the cruise and attempted to put the Dubai to Tel Aviv service into the ground, and was stopped by the captain and intervening passengers before an emergency landing in Saudi Arabia; it has since emerged that a previous employer had barred him from flying over radicalisation concerns, information that never reached those who rostered him. Emirates has suspended its codeshare on the route, and Air France, KLM, SWISS and Singapore Airlines remain suspended from the region into mid or late October, the SWISS suspension being the one with practical bearing on our readers’ Zurich connections. Paris, by contrast, offers only engineering: no strike action affects this weekend, RER C remains interrupted between Invalides and Massy Palaiseau until five o’clock, metro Line 6 is closed today for modernisation works, and sections of RER D and RER E are suspended for the weekend, with the metro and buses otherwise normal and the federations’ notice technically still live. New York is routine, with federal funding carried to 11 December, and the London, Geneva and Monaco corridors are quiet, with no new advisory or incident.

Health and privacy exposure

The United States entry order on Ebola is now in its final week: it runs through 11 October, barring foreign nationals who have been in the Democratic Republic of the Congo, Uganda or South Sudan within the previous twenty one days, and travel history over the previous three weeks should be checked before any North American movement until the order lapses or is renewed. The comparable Canadian measures continue to apply.

The deepfake file acquired its most instructive case to date. The former chairman of a major Italian private bank authorised transfers of some ninety five million euros after a spoofed WhatsApp message in the name of the banking group’s chief executive was followed by a telephone call carrying an artificial clone of a trusted law firm partner’s voice; a little over half the money has been recovered, and roughly thirty six million euros, converted to cryptocurrency, has not. The method deserves the name investigators have given it, credibility stacking: no single element was implausible, and each familiar voice vouched for the next. The operational conclusion is the one we have repeated since 29 September, and this case is why it is absolute rather than advisory: no financial or credential instruction, whatever its apparent source and however senior its apparent author, should be acted on without verification through a second, pre agreed channel. On Revolut there is no new disclosure, and our guidance on both exposures is unaltered: no engagement and no payment in the fraudulent data request affair, every approach preserved and reported, and continued vigilance for tailored phishing built on the share dealing data.