Today's briefing:
Iranian missile threat forced Trump onto a decoy flight from Turkey.
Poland arrested a Russian operative targeting a US citizen in Warsaw.
Houthi missiles killed six on a cargo ship in Bab al-Mandeb.
Welcome to your weekly briefing.
Not everyone will have been in a situation where their principal was the subject of credible intel that an attack against them was imminent. But we've all planned for it. And while those plans stay largely theoretical, every now and then they do not.
This week On the Circuit, we look at what that kind of deception really asks of a detail, and what it costs the people left carrying the visible risk.
Don’t have time to read? Watch 👇
TOP STORY
The Catering Truck
At the close of last month's NATO summit in Ankara, American and Turkish intelligence picked up something specific: a credible Iranian plan to fire a surface-to-air missile at Air Force One as the president left Turkey. The warning landed within a day of Trump's July 8 departure, and the whole thing stayed quiet for a month, until the Washington Post reported it on August 10.
Trump posted that he would fly home on the older Boeing 747 that has served as Air Force One since the 1990s. Cameras filmed him climbing its stairs. Minutes later a catering truck backed away from the aircraft, drove across the tarmac, and delivered him to a small C-32A. He flew out on that one, with a handful of aides. The jet the world was watching, still publicly identified as Air Force One, flew the same route carrying Secretary of State Marco Rubio, Treasury Secretary Scott Bessent, senior staff and the traveling press. Rubio and Bessent knew. The reporters did not, and were told to keep their window shades down.
The decision to switch aircraft was made by the National Security Council, the White House Military Office and the Secret Service, coordinated with Washington while the summit was still running. The C-32A landed in the United Kingdom at about 10:20 in the evening, and the decoy came in a few minutes behind it. Trump then transferred to the Qatari-donated 747 for the flight to Washington. We ran the sequence as it broke, and the full timeline is in our Circuit Wire report.
The switch happened in the seconds between the catering truck reaching the aircraft and the C-32A taxiing away, with no camera on it. Six months into the US war with Iran, officials say the Iranian threat to the president that drove the decision has not gone away.
Our Take
Most of our job is making a principal safe without making them predictable, and this is the hard end of that. The switch worked because the only people who knew the real plan were the ones who could not have done their job without it. Everyone else, including people standing close to the principal, was left believing the version that was made public. A decoy is only a decoy if someone is still on the aircraft everyone is watching. When we build that kind of deception into a move, we keep the knowledge to the people who need it, and we are honest with the ones left carrying the visible risk about why they are there.
Sound even smarter:
A US official told CBS News that intelligence pointed to a team inside Turkey assigned to fire the missile, though later checks found no such team in place.
The switch held for a month until the Washington Post revealed it on August 10, and Trump confirmed it on August 12, saying the aircraft he flew was at greater risk than the decoy.
READER POLL
You have to move a client through a compromised route. What do you lean on?
*Skip to the end to see the results of last week’s poll ↓
TACTICAL MEDICINE — THE CIRCUIT SPECIALIST SERIES
50% OFF — Launch Price: Newsletter Subscribers Only
When something goes wrong on a detail, the distance between an injury and a hospital is measured in minutes, and more often than not it is you standing in that gap.
Tactical Medicine is the first release in The Specialist Series, our new run of focused, practitioner-built guides to the parts of this job that carry real consequences.
It covers what to carry, what to do in the first few minutes when a casualty cannot wait, and how to keep someone alive until the professionals take over.
MEANWHILE
The Inconvenient Man
Polish Prime Minister Donald Tusk said on August 13 that his security services had arrested a Russian citizen a week earlier over a plot to kill a Ukrainian-American in Warsaw. The target was described only as a US citizen of Ukrainian origin the Kremlin considered inconvenient, and neither man was named. Tusk said the suspect had been recruited by Russian intelligence and was stopped shortly before the attack was to be carried out, in an operation run with US services. He called it the first case of its kind, someone acting on Russian orders trying to kill an American on the soil of another NATO country.
The arrest sits in a run of similar plots across Europe. French, Lithuanian and German services disrupted operations over the past year against Russian exiles, a Ukrainian military official and the head of a firm arming Ukraine, and Poland arrested a man in 2024 over an alleged plan to kill Volodymyr Zelenskyy. The Associated Press has mapped roughly 200 acts of sabotage and disruption across Europe since 2022 that officials tie to Moscow.
Who Chose the Targets?
Taiwan's Ministry of Digital Affairs confirmed on August 13 that attackers used artificial-intelligence agents to break into government systems over four days in July. The Israeli security firm Dream, which found the operation, said the software cracked 85 government accounts and took more than 2,500 personnel records, starting from a single portal and mapping 21 connected systems. The attackers built the tool on freely available agent software and got past its safety limits by telling it the job was authorized security testing.
The agents did not stop at the first targets. They spread to a government email system, IT suppliers, Taiwan's nuclear-safety agency and at least seven energy companies, scanning each for weak points. Dream did not name a culprit, but the operators' own notes were written in simplified Chinese. Researchers were careful with the word autonomous. "There's still a human in there somewhere. Somebody had to choose who to attack," said Cris Thomas of the security firm Semgrep.
He Posed as an Investor
Luigi Mangione pleaded guilty on August 14 to two federal stalking counts in the murder of UnitedHealthcare chief executive Brian Thompson. In court, the 28-year-old described how he found his target. He posed as an investor to get details of the conference Thompson was due to attend, arrived in New York more than a week ahead, and watched the places Thompson used, including his hotel and the venue hosting the company's investor day.
On the morning of December 4, 2024, Mangione positioned himself near the venue and waited. He approached Thompson from behind at about 6:45 and shot him, then fled, and police arrested him five days later in Altoona, Pennsylvania. The federal counts each carry up to life, and sentencing is set for December 18. His lawyers have asked a New York judge to drop the pending state murder charge on double-jeopardy grounds.
SNAPSHOTS
🇾🇪 Yemen. Houthi forces fired three ballistic missiles at the cargo ship Tihamah in Bab al-Mandeb on August 11, killing four crew, then struck the rescue and killed two more. The first Houthi-linked shipping deaths since February.
🇷🇺 Russia. A Ukrainian strike on Novorossiysk on August 12 hit warships and halted two of Russia's largest grain terminals, killing three and pushing Chicago wheat futures up about 3 percent.
🇮🇶 Iraq. US officials confirmed on August 12 that all American forces will leave Iraq by September 30, ending a presence dating to 2003. The Level 4 Do Not Travel advisory remains in force.
🇮🇷 Gulf of Oman. A US Navy helicopter fired two Hellfire missiles into the engine room of the cargo ship Vela Nova on August 11, disabling it after the crew ignored warnings to turn back from Iran's blockaded coast.
EXTRA INSIGHT
EXECUTIVE DIGITAL EXPOSURE. Apple sent threat notifications on August 13 to iPhone users in 110 countries, warning each that mercenary spyware had singled out their device, and the alert now appears directly on the lock screen. Apple has warned targets in more than 150 countries since 2021 and selects them for who they are or what they do, which places the kind of principals many teams protect squarely in the group these attacks pursue.
RANSOMWARE. Six US agencies and South Korea's national police issued a joint advisory on August 10 on Gunra, a criminal group that rents out its break-in tools and has hit ten sectors, from healthcare to utilities to transport. Investigators found a weakness in one version of its file-locking software that lets some victims rebuild their files without paying the ransom.
Wesco, a Fortune 500 distributor, confirmed a breach after the group ExfilSquad claimed 2.6 million records from its cloud sales system.
Cameron Curry, a departing contractor, was jailed 24 months for a $2.5 million extortion demand against the Siemens-owned software firm that had employed him.
Police in Germany and Brazil charged seven over a 30-million-euro online-banking theft that exploited a payment provider's software flaw in 2023.
NEW RESOURCE FOR PREMIUM SUBSCRIBERS
What Your Insurance Actually Covers
A security guard in St. Louis was told by the property manager to call the police, but he never made the call. When the woman he had been warned about turned up, he tried to handle her himself, pinned her, then found his handcuffs were back at the desk. He let her up, she drew a knife, and he ran. The property manager was left alone with her and was cut across the face repeatedly. The guard's insurer settled for the full policy limit of $1 million (£739,200). The company never instructed a lawyer.
That one night produced two separate claims, and most operators are covered for neither. Not making the call is a professional liability claim, and plenty of operators hold no professional liability at all. Putting hands on her is a use-of-force claim, which standard commercial general liability excludes outright or caps well below what a knife wound to the face settles for.
This week's premium piece examines the six exclusions that quietly void cover on an ordinary working day, shows why the certificate of insurance you collect from a subcontractor proves far less than you think, and sets what proper cover costs against what recent claims have actually paid. It comes with the Coverage Gap Audit, a spreadsheet that maps the work you do against the cover you hold, scores your exposure out of 100, and names your two weakest areas.
Before you go, help us build the benchmark. We are running an anonymous salary survey, open to every reader, to test how pay across this profession really holds up against the numbers. It takes a few minutes, your answers stay anonymous, and the full results go back to every subscriber later this year.
Most of us will never move a principal onto a decoy aircraft. But the thinking behind it is the same thinking we lean on every week, working out who genuinely needs to know the plan and being straight about who carries the risk when we act on it. We keep the circle small, and we tell the people trusting us the truth about what we are asking of them.
See you next week,
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at circuit-magazine.com
To give or receive feedback, hit reply.
PREVIOUS POLL - RESULTS
Q: You spot possible hostile surveillance on a client move. What action do you take?
🟩🟩🟩🟩🟩⬜️ Keep rolling but run a detection route (38%)
🟨🟨🟨⬜️⬜️⬜️ Hold and call it in for support (31%)
🟧🟧🟧⬜️⬜️⬜️ Abort and move to a safe location (28%)
🟧⬜️⬜️⬜️⬜️⬜️ Something else (3%)
Your Comments:
GS: "Even the slightest suspicion detected should result in the client being removed to a safe place. You can't hope or take a chance that your suspicion is wrong."
KB: "You should always be ready to implement any one or combination of options at any point in the operation. Things can change in a second to any threat level, and you don't take chances by dismissing your gut instincts."
***
