The First to Move

Welcome to your weekly briefing.

Every one of us has run the math on response times. You walk a new venue, you clock the exits, and somewhere in the back of your head you are counting the minutes until anyone official turns up to help. We plan around that number because we have to.

Here is the uncomfortable part. In most incidents that actually go loud, the outcome is decided long before the police arrive, by whoever happens to be closest. Sometimes that is a trained officer off the clock. Sometimes it is a guard on a door, or a stranger with a suitcase. Last week handed us three of those moments in eight days.

This week on the Circuit, we look at the person who has to act first, and what their example asks of the way we train and stand our posts.

The shooting started inside an In-N-Out in Twin Falls, Idaho at about 2:30 p.m. on Saturday, August 1, then spilled out into the surrounding shopping center. A gunman later named as 24-year-old Chad Williams killed three people, including one of the restaurant's own staff, and wounded seven before he died of a self-inflicted gunshot wound. What kept the toll from climbing further was not the police response. An off-duty Idaho State Police trooper and a local resident drew and returned fire as the gunman moved through the parking lot. Twin Falls Police Chief Matthew Hicks said their actions “helped drive the suspect away from the scene, preventing further casualties.”

The same day, in central Moscow, a woman carried an improvised explosive device toward a restaurant on Kudrinskaya Square. A security guard on the door refused to let her inside. The device went off at the entrance rather than in the packed room beyond it. The guard was killed, along with a customer and the bomber, and more than twenty other people were wounded. One decision at the threshold is the reason that number was not far higher.

Five days earlier, a man carrying two kitchen knives attacked three women in the Porte de Clichy area of northern Paris. Bystanders reached him before the police did. A young man swung a suitcase and knocked him down, a waiter pinned him with a chair, and an off-duty officer held him there until uniforms arrived. Two of the women were left in critical condition, and one was reported to be pregnant.

While these were three unrelated incidents, in very different environments, they were all dealt with in the same manner. Bystanders, who hadn't anticipated the scenarios they'd be drawn into, stood up and were counted when it mattered.

Last week is a reminder that the time it takes for help to arrive is a crucial window where whoever is on the scene has a role to play.

In our work, where we're often running with fewer resources than we'd care for, that provides a challenge, and we have a call to make. Do we go firm and wait, and if we are waiting, who are we waiting for? Or is there a window of opportunity where action could dramatically reduce the fallout?

For those of us who are decision makers, post people who have the training, knowledge, and conviction to actually turn someone away, and back them when they do.

Two decades of expert insights you can trust.

🇪🇸 Spain. Madrid deployed the army to Ceuta after about 60,000 people crossed from Morocco in days, more than half the enclave's population, with at least 34 reported dead. Italy's Giorgia Meloni threatened to suspend the Schengen open-border arrangement with Spain.

🇯🇴 Jordan. Air defenses intercepted five Iranian ballistic missiles aimed at the Muwaffaq Salti Air Base and US Central Command's headquarters in the country on July 29. Oil futures rose more than 4 percent within hours of the CENTCOM statement.

🇮🇶 Iraq. The US Embassy in Baghdad warned of drone and rocket activity across the country on July 28 and repeated the Level 4 Do Not Travel advisory. The mission remains on ordered departure, with non-emergency staff directed to leave.

🇲🇱 Mali. JNIM's fuel blockade of Bamako, running since September 2025, has pushed the national economy close to a standstill, per the UN Security Council's July forecast. The United States and United Kingdom have told their nationals to leave and drawn down embassy staff.

CRITICAL INFRASTRUCTURE. CISA told water utilities on July 30 to remove exposed control systems from the public internet after a coordinated attack disrupted operational technology at more than 30 Minnesota community water systems on July 26 and 27. The agency singled out cellular modems that sit outside routine scans, and told even utilities with mature security programs to recheck their external connections now. Investigators are examining whether Iranian hackers were responsible.

DIPLOMATIC TARGETING. The US Consulate in Toronto was struck by gunfire for the second time at about 4:45 a.m. on July 27, a single round fired in front of a marked police cruiser. A permanent police detail was posted after the March attack, which US authorities tied to an Iranian-backed scheme that recruited young people to shoot at the building. Investigators will not yet say whether the two are connected.

Coca-Cola restarted most Fairlife production eleven days after an Anubis ransomware attack halted four US plants, and confirmed the attackers stole data that is now posted online.

US and Saudi aircraft struck Iran-backed weapons and logistics sites across eastern Iraq on July 28, answering more than 30 drone attempts on American and Saudi targets in 72 hours.

Ernst & Young landed on ShinyHunters' leak site on July 27 over a breach reached through a third-party IT platform that held documents used to prepare client tax filings.

Country ratings are lagging indicators. They tell you where a place was, verified, some months ago, and this week's Bamako snapshot is a case in point.

Our newest premium briefing walks the ten environments where protective work has changed most in the last twelve to twenty-four months and, for each one, names the operating call the change forces. It covers the United States, Mexico, Ecuador, Haiti, Nigeria, Mali, the central Sahel, Saudi Arabia, France, Germany, Northern Europe, and the Myanmar-Thailand border. Mali is entry number eight, where a reported fifty-million-dollar ransom has reset the price on every wealthy foreign national in the region. It ships with a downloadable reference that scores all ten environments across six drivers and lets you score a specific deployment for readiness, Go, Caution, or Hold, before anyone commits to it.

Read it and score your next deployment →

Premium subscribers get the full briefing and the toolkit. Not premium yet? Upgrade for subscriber-only tactical analysis and every future briefing.

Q: A drone appears over your site. What happens next?

🟩🟩🟩🟩⬜⬜ A. We call it in and log it (57%)
🟧🟧🟧⬜⬜⬜ B. Honestly, nothing. No process (29%)
🟨⬜⬜⬜⬜⬜ C. Our own detection kit flags it first (7%)
🟨⬜⬜⬜⬜⬜ D. Something else. Tell us (7%)

Your Comments:

JTP: “Technically speaking, we go into lockdown. But the reality, and costs, of doing so hasn't set in on leadership. Luckily we get very few errant drones and our plan hasn't been tested.”

PC: “Keeping a shotgun with Skynet or other counter-drone rounds for SHTF seems prudent. Survive and deal with the rule later.”