In partnership with
: Today's briefing:
The grandfather of a crypto fund executive was kidnapped in California.
Two armed men took $1.8 million from a truck in under a minute.
Wyoming's highway patrol is cross-training its SWAT unit for executive protection.
Welcome to your Tuesday briefing.
Protection models tend to be built around the principal. That's where the threat assessment starts, and often where it ends. It's a reasonable approach, until the threat moves outside that coverage.
Don’t have time to read? Watch 👇
TOP STORY
The Outer Ring
On March 16, 2025, a 74-year-old retired man named Naiping Hou left his home in Rancho Cucamonga, California, for a fishing trip and did not come back. His son, Wen Hou, is the chief investment officer at Coincident Capital, a prominent cryptocurrency hedge fund. Investigators now believe Naiping Hou was targeted not because of anything he owned, but because of what his son controlled and that the people responsible for his disappearance had spent months preparing before they moved.
Naiping Hou had no public profile. He was retired, lived alone, and had no visible connection to the crypto world that made his son wealthy. That is what investigators believe made him the target.
In January 2025, plumbing contractors arrived at Hou's Rancho Cucamonga home following water damage. Wen Hou later told investigators those contractors may have gathered intelligence during their visit: the property layout, the father's daily routines, the absence of any security measures. In mid-March 2025, Naiping Hou disappeared.
The Fake Facade
What followed was 47 days of engineered silence. The perpetrators used Hou's phone to send ordinary texts to his wife in China and his son in Nevada, keeping both from raising an alarm. Family friends who eventually visited the property on May 4, 2025 found it stripped of furniture and freshly repainted. A professional sanitization of a crime scene, completed while the family was still receiving messages from a dead man's device.
In parallel, over a million dollars was moved out of Hou's accounts and converted into gold bullion and untraceable cryptocurrency, methods that route around standard banking fraud detection. Investigators suspect foreign nationals entered California under false identities to carry out the operation. Naiping Hou is presumed dead. The FBI formally joined the case in April 2026. The San Bernardino County Sheriff's Department has issued a $250,000 reward.
The attack did not need Wen Hou. It needed the one person in his extended network who was entirely unwatched: an elderly father, living alone, with no security awareness and no formal connection to his son's professional world.
Our Take
Most of the coverage will focus on the cryptocurrency; the $3 million demand, the Ethereum wallets, the digital evidence trail. We'd argue the more intresting detail is the plumbing contractors. If investigators are right about the timeline, this operation was running from January, inside a family home, months before anyone had reason to be concerned, and inside a space no protection protocol was ever going to reach.
It worked because the assumption that a principal's family members fall outside the threat picture is almost never questioned. Most protection profiles don't extend that far, and the Hou case is a reminder to consider whether yours does.
READER POLL
When a principal's parent is kidnapped to access their wealth, was it an EP failure?
This week’s briefing is brought to you in partnership with:
Stay in flow state. Dictate everything else.
Context switching kills your focus. Every time you stop coding to type a Slack reply, write a ticket, or draft a PR description, it takes 23 minutes to get back in the zone.
Wispr Flow lets you dictate all of it without leaving your editor. Speak your response, your ticket, your commit message — Flow formats it and you're back to coding. Works system-wide inside Cursor, VS Code, Warp, Slack, Linear, and every app.
4x faster than typing. 89% of messages sent with zero edits. Used by engineering teams at OpenAI, Vercel, and Clay.
MEANWHILE
A Professional Crew Hit a Philadelphia Brinks Truck for $1.8 Million in Broad Daylight
At 9:45 on the morning of April 21, two men in black exited a blue Acura SUV on Torresdale Avenue in the Tacony neighborhood of northeast Philadelphia. They were carrying assault rifles. They confronted the Brinks driver and courier, seized bags of cash, and were back in the vehicle within seconds. $1.8 million taken in broad daylight. No injuries. No arrests.
The getaway vehicle turned up abandoned under Interstate 95 near Fairmount Avenue shortly after. The FBI is now leading the investigation. The speed of the extraction and the choice of weapons in a residential area at the start of the working day point to a crew that had scouted the vehicle's route and stop pattern in advance.
Brinks vehicles continue to be selected as specific targets by organized, armed crews. Route variance, coordinated driver-courier communication, and a real-time reporting chain when a vehicle deviates from schedule are the operational baseline against this threat profile.
When SWAT Runs EP
The Wyoming State Highway Patrol has established a special response team that functions as a SWAT unit but has been cross-trained for executive protection: VIP transit, site security, counter-ambush procedures. The same team covers both. Alongside it, the state has designated a single trooper assigned full-time to protective intelligence, who recently completed threat assessment training at the U.S. Marshals Service headquarters in Crystal City, Virginia.
The context to this is the assassination of a state lawmaker in 2025. Multiple law enforcement agencies across the country are now in active dialogue about what adequate protection for elected officials looks like, and Wyoming's model is an early indicator to how that conversation might go.
Sound even smarter:
In March 2025, a federal judge in Washington D.C. sentenced two members of the Choppa City crew to 47.5 and 31.5 years respectively for three Brinks armored car robberies carried out between 2021 and 2022. One of those operations involved the kidnapping and physical detention of two female couriers, who were forced under threat of violence to bypass the vehicles' time-locked safes. Over $1.2 million was taken across the three robberies.
SNAPSHOTS
🇪🇨 ECUADOR — A military-enforced nightly curfew runs from 11 p.m. to 5 a.m. across nine provinces, effective May 3 through May 18. Violations carry immediate detention by the Armed Forces and National Police. Travelers with valid documentation en route to Quito or Guayaquil airports are the only exemption.
🇭🇹 HAITI — The final withdrawal of approximately 500 Kenyan police officers from the UN-backed Multinational Security Support Mission was completed April 27. The incoming Chadian-led Gang Suppression Force is not expected to reach full operational strength until October 2026.
🇿🇦 SOUTH AFRICA — Mob violence targeting migrant communities has killed at least two Nigerian and four Ethiopian nationals in recent weeks, with additional allegations of local security personnel involvement. On May 4, Nigeria summoned South Africa's acting High Commissioner in Abuja and announced voluntary repatriation flights for citizens seeking to leave.
🌐 STRAIT OF HORMUZ — The UK Maritime Trade Operations has logged 41 incidents in the Strait of Hormuz and Gulf of Oman since February 28: 23 direct attacks, 16 suspicious activities, and two hijackings.
EXTRA INSIGHT
INDUSTRY — Following a Statutory Instrument laid before Parliament on May 1, security workers who report licensing fraud, regulatory violations, or criminal activity within their employer to the SIA will hold statutory protection from retaliation. SIA chief executive Michelle Russell has described the designation as a way to support workers who raise "genuine concerns" about wrongdoing in the sector.
TRAVEL RISK — The U.S.-Israel military campaign against Iran, launched February 28, has created a jet fuel shortage now disrupting international commercial aviation. Jet fuel prices have doubled since March. Lufthansa has cut 20,000 flights through fall. More than 52,000 flights have been cancelled globally, and airfares are up 5 to 10 percent. Airlines and government advisories have warned the disruption is likely to continue through the core summer travel season.
RECOMMENDED READING
AI in Security? The Decision Has Already Been Made
Most security organizations are still debating when and whether to adopt AI. While that conversation is happening, adversaries have already moved. Deepfake video calls are being used to authorize real fund transfers. OSINT tools can build a detailed picture of a principal's life in hours. Social engineering now runs at scale without a person behind it.
In 2024, an employee at a multinational company authorized a significant fund transfer during a video call with what appeared to be company executives. None of them were real. No malware, no system breach — just AI-generated video convincing enough to work.
The harder question isn't adoption. It's governance — who inside your organization is responsible for how AI gets used, what the boundaries are, and what the gaps look like when nobody has been given that brief. For security leaders who are ahead of the technology but behind on the governance, this is a useful place to start.
The Hou case involved at least two months of surveillance on family members who had no protection profile, no coverage, and no reason to expect one. The Brinks crew had the route, the timing, and the exit plan before a single vehicle moved. Wyoming lawmakers had no state-level executive protection capacity until a senator's near-miss forced them to build one. In each case, the threat actor had completed the threat assessment. The question is who gets there first.
See you next week.
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at circuit-magazine.com
To give or receive feedback, hit reply.
PREVIOUS POLL - RESULTS
Q: Was this a security failure, or just the reality of protecting public figures?
🟨🟨⬜️⬜️⬜️⬜️ Failure. The suspect should never have reached the checkpoint with three weapons (18%)
🟨🟨🟨⬜️⬜️⬜️ Reality. Public figures will always be vulnerable; the system held where it had to (26%)
🟩🟩🟩🟩🟩🟩 Both. The reality makes the job hard, but does not excuse what was missed (52%)
⬜️⬜️⬜️⬜️⬜️⬜️ Other. Let us know your thoughts → (4%)
Your Comments:
DA: “Allowed to happen for political gain, like the previous two times.”
JMC: "The reality is, this is now the world we live in and you simply cannot protect against every threat.”
MS: “There are glaring gaps, as well illustrated in this article. I was also surprised to see both the President and Vice President at the same venue as well as other high ranking members of the administration given the current global situation?”
SK: “Any access points leading from the hotel to the basement should have been picked up by the advance team and secured.”
***
Daily news for curious minds.
Be the smartest person in the room. 1440 navigates 100+ sources to deliver a comprehensive, unbiased news roundup — politics, business, culture, and more — in a quick, 5-minute read. Completely free, completely factual.
