Today's briefing:
Houthi strikes on Riyadh's airport killed 13, including an American.
FBI says a Minnesota teen planned a Mall of America shooting.
Leaked chats show extortion crew sending fake IT staff into law firms.
As protectors, we put a lot of effort into controlling how a principal moves. We assess the route, arrange the transport and make sure somebody is waiting at the other end. But part of almost every journey depends on people and infrastructure we cannot control, and an airport is one of the clearest examples.
This week, Houthi missiles struck Riyadh's main airport four times in five days. A terminal full of passengers became a target in a conflict being fought across the border in Yemen, leaving travelers from several countries among the dead.
So, how do you judge whether a journey is still reasonable when the airport itself has become part of the fight? This week, On the Circuit, we look at why Saudi airports are being targeted, what is driving the escalation and what that means for the people we move through them.
Don’t have time to read? Watch 👇
TOP STORY
Houthi Missiles Hit Riyadh's Airport Four Times in Five Days

A Houthi missile struck a passenger terminal at Riyadh's King Khalid International Airport on Saturday, October 10, killing 13 people and wounding more than 300, CBS News reported. The dead included a US citizen and a Flynas flight attendant, Azza Ramzy, and came from at least eight countries, according to the Saudi casualty list. On Sunday a projectile hit domestic terminals 3 and 4, killing a Pakistani resident and injuring 11, and King Fahd International Airport in Dammam was also struck. The Riyadh airport has been hit four times in five days and has been closed since Saturday, Al Jazeera reported. It is the deadliest attack on the kingdom since the US-Israel war on Iran began in late February.
The strikes follow a Saudi push on the ground. The UN-brokered truce that had mostly held in Yemen since 2022 has collapsed, and in July the Houthis declared a maritime embargo on Saudi Arabia. In September they seized the Red Sea port of Mocha. On October 4, Saudi-backed Yemeni government forces launched an offensive they call "Dawn of Yemen" to take it back, along with Mayyun Island near the Bab al-Mandeb strait, Al Jazeera reported. The government says it has retaken Mocha, which the Houthis dispute. The Houthis have named Riyadh's airport and the state oil company Aramco as the kingdom's "most precious assets," and since the offensive began they have also claimed strikes on airports in Jizan, Najran, Abha and Dammam.

The fight has drawn in outside militaries. On October 5, Saudi Arabia, Turkiye and Pakistan invoked their Mecca Alliance defense pact for the first time since signing it in August and agreed to deploy forces to the kingdom, according to Al Jazeera. About 100 coalition fighter jets are supporting the offensive. Washington said last month it had no plans to join, but after Saturday's strike President Trump told reporters, "We may. We're going to look at it," and said he would speak to Crown Prince Mohammed bin Salman, Time reported. Iran, which backs the Houthis, said it was "deeply concerned" and that the escalation would "only benefit" Israel.
The Houthis say Saudi airports and airspace are now "exposed to targeting," except over Mecca and Medina, and have told passengers not to travel. US government employees now need special authorization to use the airports in Riyadh, Jeddah and Dammam, though the public US advisory stays at Level 3, the US Mission's alert says. Germany, Australia and Canada advise against all travel to Saudi Arabia. Lufthansa, Emirates, Etihad, flydubai and Air India are among the carriers that have suspended Riyadh flights.
Our Take
These strikes should be understood as an attempt to make Saudi Arabia pay for its offensive in Yemen. The Houthis have named airports and Aramco as the kingdom's most precious assets, and hitting a passenger terminal creates consequences far beyond the damage to the building. Travelers are killed, airlines suspend services and the disruption becomes an international concern.
That is what makes the repeated attacks significant. This was not one strike followed by a return to normal. Riyadh's airport was hit four times in five days, while other Saudi airports were also targeted.
The offensive is continuing, and so is the reason for retaliation. Washington entering the fight might change its scale, but there is little here to support treating the airport attacks as a finished episode. Saudi Arabia's civilian transport infrastructure has been drawn into the conflict, and the people using it are carrying the consequences.
Sound even smarter:
The Saudi-led coalition entered Yemen's civil war in March 2015, and the Biden administration ended US support for its offensive in 2021, a year before the UN truce that has now collapsed, Al Jazeera noted.
An AP-NORC poll on October 1 found 69% of Americans think the war with Iran was not worth fighting, and Trump has said the US will not attack Iran before the November 3 midterms, Time reported.
READER POLL
Which source do you trust most when a travel picture changes overnight?
*Skip to the end to see the results of last week’s poll ↓
CIRCUIT SPECIALIST SERIES

SURVEILLANCE & COUNTER-SURVEILLANCE
Vol 2: Specialist Series
25 of the best surveillance and counter-surveillance articles in one 180-page training volume. Written by a retired CIA security officer, former special forces soldiers, government surveillance operators, investigators and close protection specialists.
MEANWHILE

FBI Says Minnesota Teen Planned Mall of America Shooting for Hmong Festival
The FBI arrested Sheikhdoon Abdullahi Mohamud, 18, of Richfield, Minnesota, on October 6 after he allegedly paid an undercover agent posing as an ISIS member about $600 for an AK-47-style rifle, made inert by the FBI, and about 200 rounds, the Justice Department said. Prosecutors say he planned to attack the Mall of America on October 24, the day of a Hmong arts celebration there, and told a confidential source he wanted to kill 30 to 60 people.
The case began in December 2024, when he started messaging the source about joining a terrorist group in Somalia, a trip he later decided he could not afford. Agents visited his home in May 2025. Over the summer he discussed the mall as a target and sent a video pledging allegiance to ISIS, according to the complaint. He is charged with receiving a firearm to commit a federal crime of terrorism and is presumed innocent.
Russian Extortion Gang Sent Operatives Into US Law Firms
A leaked archive from the Silent Ransom Group, a Russian extortion crew, shows it sending US-based operatives into victims' offices posing as IT staff to get at their computers, The Record reported. The chats run from August 2025 to September 2026 and name about 50 organizations, most of them law firms. The crew claims about $200 million in settlements, with demands opening at $100,000, and one New York firm's representative said it had authorized $1 million to settle.
Recruits came through paid Telegram ads posing as courier, nightclub and security jobs, and the leader reckoned only one in ten was usable. Planning notes mention a pizza-delivery disguise, smart glasses for filming inside offices and a $3,200 printer for making ID cards, though the archive does not show which ideas were used. Cryptocurrency addresses in the leak match known extortion payments, The Register reported.
SNAPSHOTS

🇿🇦 South Africa. Anti-immigration protests burned at least 24 vehicles in Durban and Soweto and three houses in Durban last week. The US consulate urged extreme caution in central Durban.
🇪🇹 Ethiopia. Ethiopia told the UN Security Council it faces an "all-out invasion" by Eritrean forces up to 60 km inside its north. Federal troops retook Mekelle on October 4.
🇮🇳 India. More than 30,000 police locked down central New Delhi on October 10 against youth protests over voter rolls, halting trains and metro and cutting mobile internet. Thousands were detained.
🇶🇦 Qatar. A tanker was hit by several projectiles 51 nautical miles north of Qatar on October 7, with crew casualties. Iran has threatened ships using routes it has not authorized.
How Protective Details Spot Hostile Surveillance Before an Attack

Seeing the same person or vehicle twice can mean something, or it can mean very little. The difficulty for a protective detail is knowing which, before the watching becomes an attack. Recent US cases show hired operatives spending weeks observing targets, often returning to the same few locations. That repetition creates an opportunity, provided somebody recognizes and records it.
This week's Premium article examines four cases and explains how to turn those observations into a method your detail can use. We cover the TEDD test, building a surveillance detection route into an ordinary day and working with a two-person team. You'll also get the Surveillance Detection Route Planner and Sighting Log to help you identify repeat appearances and assess the pattern.
EXTRA INSIGHT
PUBLIC-FIGURE PROTECTION. Joshua Kerry, 28, accused of murdering former MP Ann Widdecombe at her Devon home in July, tried to get into Nigel Farage's London home in April 2025, prosecutors told the Old Bailey on October 9, leaving a blade mark on the door and lighter fluid in the porch. His phone allegedly held politicians' home addresses. Trial is set for June 2027.
MILITARY SITE SECURITY. Two Latvian men were arrested inside RAF Molesworth, a US Air Force intelligence site in eastern England, after a patrol found an abandoned car and a hole in the fence late on October 7. Counterterrorism police are investigating and the pair have been bailed. It follows the September arrests near RAF Fairford, though police see no link so far.
Arizona's court system said phishing-led hackers copied records on 1.3 million people, plus foster-care reports and protective-order files.
The FBI and Secret Service warned criminals have broken into more than 86,000 Fortinet firewalls and remote-access gateways and are selling the access to ransomware gangs.
Zohar Pinhasi, owner of a Florida ransomware recovery firm, was charged with secretly paying hackers while telling clients he could unlock their files without paying.
We cannot decide where a conflict goes next, but we may still have to decide whether a principal travels through it. That judgment needs more than a list of the latest incidents. It needs an understanding of what is driving them and whether those conditions have changed. A flight resuming or a terminal reopening may solve the immediate transport problem without resolving the threat. Before we put the journey back on the schedule, we need to be clear about which problem has actually been solved.
See you next week,
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at circuit-magazine.com
To give or receive feedback, hit reply.
PREVIOUS POLL - RESULTS
Q: Which trusted role around your principal gets the least scrutiny?
🟨🟨🟨⬜️⬜️ Long-serving household staff (40%)
⬜️⬜️⬜️⬜️⬜️ Pilots and drivers (0%)
🟩🟩🟩🟩⬜️ The family's own contacts (47%)
🟧⬜️⬜️⬜️⬜️ The security team (7%)
🟧⬜️⬜️⬜️⬜️ Something else. Let us know → (7%)
AG: “Me. I get the least scrutiny.”
***




