Today's briefing:
California deputies arrest a man casing Trump's golf club before a visit.
An explosive drone is found beside Ukrainian cargo jets at Leipzig airport.
One phishing email exposes a US Patriot-missile connector maker.
Welcome to your weekly briefing.
As protectors, we put a great deal of faith in the advance. Long before a principal sets foot anywhere, we have walked the ground, found the ways in and out, and worked out where a problem is most likely to begin. It is one of the most valuable things we do, and most of the time, nobody but us ever knows it happened.
What we tend to think about less is that the same homework can be done against us. Anyone planning to cause harm has their own version of the advance, and when a principal keeps returning to the same club or the same office, a patient watcher not only identifies the routine, they see the vulnerabilities as well. So, while we're watching, it's also worth considering what we're showing because at some point, someone will be watching.
This week On the Circuit, we look at hostile surveillance, at how it tends to give itself away, and at the people who read the signs two days before anything happened.
Don’t have time to read? Watch 👇
TOP STORY
Cased Twice
Jeanine John Taele walked the grounds of Trump National Golf Club in Rancho Palos Verdes on July 31, taking photos and video of the security preparations while wearing an earpiece. Plainclothes federal agents flagged him as a suspicious person. Two days later, on August 2 and two days before a scheduled presidential visit, he came back. This time deputies found a sixteen-round magazine of hollow-point bullets in his pocket and a loaded pistol in his car. He told them he was State Department, there for the security detail.
He was not. A search of his Downey home the next day turned up an illegally modified AR-platform rifle, a .45-caliber pistol, body armor, high-capacity magazines, ammunition, two radio signal devices, and notebooks the sheriff's department described as containing concerning statements. Taele, 38, is a Marine veteran who served in Iraq and Afghanistan between 2008 and 2016. He pleaded not guilty to state and federal weapons charges plus a separate robbery count, and a judge set bail at $250,000 and ordered him to stay away from the course.
Taele's behavior over those two days was a fairly ordinary piece of hostile reconnaissance, carried out more or less in plain view. He chose a venue his target came back to on a predictable rhythm. He returned rather than settling for a single pass. He pointed his camera at the security arrangements themselves rather than the clubhouse or the coastline, and he tried to pass himself off as one of the team, claiming a State Department detail and wearing the earpiece to help it land. Investigators associate each of those behaviors with the run-up to an attack. The agents who had noticed him on the first day recognized him when he came back on the second. Deputies said there was no credible threat to the community. The full arrest detail is in our Circuit Wire report, and the Los Angeles County Sheriff's account fills in the rest.
Our Take
It would be easy to read this as a story about a man with a serious amount of hardware, and to quietly file it under things that happen to other people's principals. We would read it differently. The reason it did not turn into something worse is that a human being noticed another human being doing something a little wrong, saw it twice, and decided it was worth acting on rather than explaining away.
An adversary latches onto a predictable routine, and every repeat visit hands them another look at where the principal is exposed. That same repetition works against us too, because familiar ground stops holding our full attention and the gaps widen. This is where the people who work the site every day earn their place in the plan, since they will notice a change in the pattern long before we do. It pays to talk to them. Whoever is watching your setup is counting on you not watching back.
Sound even smarter:
The US Secret Service's National Threat Assessment Center studied 173 mass attacks from 2016 to 2020 and found attackers routinely showed observable warning behaviors that others noticed before the violence.
In September 2025 a federal jury convicted Ryan Routh of trying to assassinate Trump at his West Palm Beach golf club, where a Secret Service agent spotted a rifle in a tree line one hole ahead. Routh was later sentenced to life plus 84 months.
READER POLL
You spot possible hostile surveillance on a client move. What action do you take?
*Skip to the end to see the results of last week’s poll ↓
This week’s briefing is brought to you in partnership with:
Stop Paying for 6 Tools. One AI Does It All.
Most e-commerce sellers juggle 6–8 tools and pay hundreds monthly to keep operations running. StoreClaw replaces the stack with one autonomous AI engine that monitors competitors, optimizes listings, automates marketing, and tracks profit 24/7. Connect your store and let AI handle the work — no prompts, no complex setup, no credit card required.
MEANWHILE
Beside the Runway
Shortly before midnight on August 4, a worker at Germany's Leipzig/Halle airport found a drone carrying an explosive device near the south runway. A police robot removed the detonator before it was defused, but both runways closed, several flights diverted, and a second object struck a freighter that had aborted its landing. German authorities have named no suspects, and the interior minister called the find a new quality of danger.
Leipzig/Halle is one of Europe's busiest air-freight hubs and has hosted Ukraine's Antonov cargo fleet since 2022. The same airport was hit by a Russia-linked arson attack in 2024, one of dozens of sabotage cases across Europe tied to Russia and its proxies. Prosecutors who handle politically motivated crime are leading the investigation and have not said whether the cargo planes were the target.
One Email In
IEH Corporation is a small Brooklyn manufacturer whose connectors sit inside the Patriot and THAAD air-defense systems, the AMRAAM missile, fighter jets, and satellites. On August 6 it told regulators that an intruder had phished an employee's Microsoft 365 login four days earlier, using a fake document-sharing link from someone posing as a business contact. The attacker reached mailboxes holding purchase orders and engineering documents, some of it potentially export-controlled.
IEH says it found no sign the files were copied, though they sat open to the intruder throughout. The company, which reports close to $30 million in annual revenue, has not named who was behind the attack. Federal agencies have warned for years that phishing is the most common way state-linked hackers first get a foothold inside defense suppliers.
Where the Off-Ramp Went
On August 9, Benjamin Netanyahu told his cabinet that Israel rejects the US-backed fifteen-point roadmap Trump's Board of Peace published on July 31 to phase an Israeli withdrawal against Hamas disarmament. The Board had announced an agreement with Hamas to give up its weapons only a week earlier. Netanyahu said there would be no pullback until Hamas is genuinely disarmed, and that the military would keep operating in the meantime. He spoke three months before an Israeli election his coalition is on course to lose. Hamas said it remained committed to the roadmap it had already agreed.
SNAPSHOTS
🇸🇦 Saudi Arabia. Houthi missiles killed more than 30 Yemeni soldiers on August 6, and on August 9 a drone hit a Saudi Aramco refinery at Jizan, put out with no injuries. Riyadh is bracing for strikes on its energy sites and airports.
🌐 Middle East. US embassies told Americans on August 1 to be ready to leave the region, citing flight cancellations and airspace closures, and warned Iran may strike US-linked sites, including in Egypt.
🇮🇶 Iraq. The US Embassy in Baghdad renewed drone and rocket warnings, and Iran-backed militias postponed a threatened response to US-Saudi strikes after Iraqi forces moved toward Baghdad. Level 4 Do Not Travel and ordered departure remain.
🇲🇽 Mexico. The US government suspended official activities in Michoacán on August 5 over a threat to Americans, then partially resumed on August 8. Michoacán and Tamaulipas stay Level 4 Do Not Travel for crime and kidnapping.
EXTRA INSIGHT
REMOTE ACCESS. Three products that companies use to manage their computers from a distance were found to have serious security holes, and attackers used them to break in and take control of the machines underneath. US authorities ordered federal agencies to urgently patch flaws in Progress LoadMaster and N-able N-central, while the INC ransomware gang exploited weaknesses in SonicWall remote-access equipment to seize devices.
DEFENSE INDUSTRY. Deputy Defense Secretary Steve Feinberg gave weapons makers 21 days to submit plans for faster, larger production, writing that years-long development cycles are no longer acceptable as the Iran war drains US interceptor stocks. The Pentagon is boosting Patriot and THAAD output.
Levi Strauss told the SEC that hackers tricked employees into granting access to three company laptops and stole corporate data, with no customer records hit.
Amgen disclosed that attackers stole patient health data and proprietary files from third-party cloud systems, and would not say whether a vishing call was involved.
A group called ExfilSquad leaked names and work emails for more than 100,000 UK police and justice staff after breaching the Police National Legal Database.
NEW RESOURCE FOR PREMIUM SUBSCRIBERS
Which Certifications Actually Pay You Back?
Most of the advice you have heard about certifications came from the people selling them, which is worth remembering the next time a course promises to lift your rate by some impressive figure. This week's premium piece looks at what actually holds up. It sorts the major security and EP credentials by the job each one really does: the licences a country or state requires before you can legally take the work, the qualifications that get a résumé past a corporate buyer, the hands-on certificates a client can genuinely test, like trauma medicine and protective driving, and the course badges that look good on paper but rarely change what anyone will pay you.
It then weighs the real cost of each against the return, setting the fee and the days spent off the tools against the rate a credential can realistically command, and it is candid about where the evidence for a pay rise is thin. Premium subscribers also get the Credential Value Model, a spreadsheet that tests any qualification against your own day rate and how much you actually work, so you can judge the payback before you spend the money rather than after.
Premium subscribers get the full breakdown and the toolkit. Not premium yet? Upgrade for subscriber-only tactical analysis and every future briefing.
None of this is an argument for paranoia. It is an argument for trusting your own instincts the same way you would the physical plan. When a face turns up somewhere you are fairly sure it has turned up before, that is worth a proper second look and a note in the log rather than a shrug on a busy afternoon. And the operator who tells you something feels off is worth hearing out, and worth giving a simple way to pass it up the chain. We put real care into studying the ground before our principals ever arrive. It seems only fair to assume that someone, somewhere, might be studying us just as carefully, and to make sure that if they are, they see that we're paying attention.
See you next week,
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at circuit-magazine.com
To give or receive feedback, hit reply.
PREVIOUS POLL - RESULTS
Q: Off duty and something kicks off ten feet away. What do you actually do?
🟩🟩🟩⬜⬜⬜ A. Move in and try to stop it (53%)
🟨⬜⬜⬜⬜⬜ B. Get people out and create distance (13%)
🟧⬜⬜⬜⬜⬜ C. Cover, observe and call it in (20%)
🟨⬜⬜⬜⬜⬜ D. Something else. Let us know → (13%)
Your Comments:
RR: “Observe the situation, evaluate if direct action needed or not, act accordingly.”
***
