MEFILES — Daily Intelligence on the Region's Hard Questions

Iran File — Lead

Three Chokepoints Are Now Contested and the Alliance Announced to Guard Them Obliges No One to Sail

Egypt’s cabinet said on Thursday that a drone started Wednesday’s fire on two gas vessels at Damietta, on the Mediterranean approach to the Suez Canal. No state, militia or coalition has claimed it. The same day in Riyadh, forty-three delegations produced fourteen signatures on a maritime alliance whose founding text makes deployment a matter for each capital to decide. Hormuz, Bab al-Mandeb and now the Egyptian Mediterranean are contested at once, and the security architecture announced to cover them commits nobody to anything.

MEfiles · Iran File · July 31, 2026

The Alliance in Four Figures

Riyadh's Multinational Maritime Defence Alliance as announced on 30 July 2026

States represented at the Riyadh meeting

Signatories to the joint declaration

Signatories from North America or Europe

Members obliged to deploy vessels

Saudi Ministry of Defence, via QNA, Anadolu and AFP

Hormuz Transits, Year on Year

Average daily ship transits, late June to early July, 2025 against 2026

IMF PortWatch, compiled by Statista

Egypt’s cabinet said on Thursday that preliminary investigations had found a drone caused the fire that broke out a day earlier on two gas vessels at Damietta port, and that authorities were taking measures “to protect Egypt’s national security.” The oil ministry’s own statement on Wednesday had confirmed a fire and no injuries and named no cause, saying only that “the situation was handled immediately in accordance with emergency and rapid response plans.” The British maritime security firm Ambrey said on Wednesday that a drone had hit a US-owned gas storage tanker, later identifying it as the floating storage and regasification unit Energos Winter. Reuters, citing three trading sources familiar with the incident, reported that the fire spread to a second vessel, the Gaslog Salem, and that both were moved offshore. Nobody has claimed the strike. The Times of Israel carried a photograph captioned as a “reported Iranian drone strike” while its own text said no party had claimed responsibility; a caption is not an attribution, and more than a day later there is no attribution of any kind. Kpler said operations were disrupted at one of Egypt’s main gas import terminals.

In Riyadh the same day, the Saudi Ministry of Defence announced a Multinational Maritime Defence Alliance covering the Bab al-Mandeb, the Red Sea and the Gulf of Aden, at the close of a meeting attended by chiefs of staff or their representatives from 43 countries plus the EU delegation to Saudi Arabia. Fourteen states signed the joint declaration, and the published lists do not match: Qatar News Agency and The New Arab, both citing the Saudi statement, include Nigeria and Sudan; Anadolu’s list includes the Comoros and omits both. Neither version contains the United States, the United Kingdom, France, India or China. The members are regional or Muslim-majority states plus Türkiye, and “Yemen” here means the internationally recognised government, itself a party to the war against the force the alliance is directed at. The declaration says the alliance “does not target any state, alliance, or international organization,” that the door “remains open” to others, and — the operative sentence — that participation in operational activities “will remain a sovereign decision for each member state in accordance with its national laws.” Planners are still drafting the charter, the command-and-control arrangements and the operational framework. The Houthis declared a maritime blockade of Saudi Arabia on 20 July.

On the other side of the peninsula, two readings of the same water published on Thursday morning point in opposite directions. Bloomberg reported at 06:55 UTC that Hormuz traffic had picked up in recent days, with the United States saying its navy had escorted some tankers across. NBC News' vessel tracker, updated at 10:57 ET, said traffic was back down after a brief pick-up and “nowhere near the hundred-plus ships a day” that crossed before the war. The one series with a stated methodology, IMF PortWatch as compiled by Statista, puts transits at roughly 25 a day between late June and early July against roughly 100 a day a year earlier. The IRGC said on Thursday that two tankers “encouraged by American aircraft” had attempted the southern route overnight and turned back after a major fire aboard one of them; it named no vessels, no owners and no position, omissions IranWire itemised. CENTCOM, which maintains the passage is open, said on 21 July that US forces had assisted about 900 commercial vessels carrying 450 million barrels, a cumulative figure with no start date. Brent’s prints disagreed too: Fortune had it at $92.65 on Thursday morning, up $3.12; Trading Economics had it down 0.78 per cent at $90.04.

Assessment: The value of the Riyadh declaration is that it costs nothing. A text that leaves deployment to each capital’s discretion can be signed by Pakistan, Bangladesh and Djibouti without a hull ever moving, which is why fourteen governments could sign it in a single afternoon — and why the wire comparisons to Prosperity Guardian and Aspides flatter it. Read it as a Saudi political instrument, evidence that Riyadh can convene forty-three flags without Washington in the room, rather than as a force that exists. Distrust three things today. The membership list: two agencies published different versions of the same document, and until the ministry posts its own text nobody outside it knows who joined. The traffic story: two wires read one strait in opposite directions on the same morning, and neither published its counting rule. And the Damietta vacuum: an unclaimed strike is useful to everyone, so the first confident attribution will tell you more about whoever makes it than about the drone.

Sources: Reuters via US News — Egypt confirms drone caused fire on two gas vessels at Damietta · The National — Egypt says Damietta port ship fire caused by drone · Qatar News Agency — At least 14 countries announce multinational maritime defence alliance · Anadolu Agency — Saudi Arabia and 13 countries establish maritime coalition (different membership list) · NBC News — Strait of Hormuz traffic tracker, updated 30 July 10:57 ET · Bloomberg — Hormuz shipping traffic picks up despite hostilities · Statista, citing IMF PortWatch — ship traffic in the Strait of Hormuz · IranWire — IRGC says strait closed while US threats persist; names no vessels

The Cartoon — July 31

“The escort is voluntary. The toll is not.”

MEFILES · the cartoon · Fourteen states sign a maritime alliance in which operational participation ‘will remain a sovereign decision for each member state'

14 of 43

states that signed Riyadh’s maritime declaration, out of those represented at the meeting that produced it

Saudi Ministry of Defence, via QNA and Anadolu, 30 July 2026

918

civilians killed in Mali in 2025 by the Malian military and Russian paramilitaries, nearly four times the toll attributed to their main Islamist adversaries

ACLED, cited by Reuters, 31 July 2026

80%

share of conflict-related civilian deaths recorded in Sudan from January to May 2026 that came from drone strikes

OHCHR, via Deputy High Commissioner Awa Dabo at the 62nd Human Rights Council session

30+

Minnesota water and wastewater systems with confirmed malicious activity; no US agency has attributed the intrusion on the record

Minnesota IT Services; the New York Times puts the figure near 36

incompatible orders of operations for Gaza disarmament published inside eighteen hours — Trump’s, his own Board of Peace’s, and Hamas’s

Truth Social; Board of Peace statement via CNN; Razi Hamad to Al Jazeera, via Axios

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.

Claimed, Not Confirmed

Egypt Says a Drone Started the Damietta Fire, and No One Has Said Whose

Cairo’s cabinet moved from an oil-ministry statement that named no cause to a preliminary finding of a drone strike in twenty-four hours. Attribution is still empty, and one Israeli outlet filled the gap in a photo caption.

A fire broke out on two gas vessels at Egypt’s Damietta port on Wednesday 29 July. The oil ministry’s same-day statement confirmed a fire and no injuries and said “the situation was handled immediately in accordance with emergency and rapid response plans” — it gave no cause. On Thursday the Egyptian cabinet said preliminary investigations found the fire was caused by a drone, and that authorities were taking necessary measures “to protect Egypt’s national security.” The British maritime security firm Ambrey had said on 29 July that a drone struck a US-owned gas storage tanker, later identified as the floating storage and regasification unit Energos Winter. The spread of the fire to a second vessel, Gaslog Salem, rests on three trading sources familiar with the incident, cited by Reuters; two separate security sources assessed the cause as a drone. Both vessels were moved offshore. Kpler said operations at one of Egypt’s main gas import terminals were disrupted.

No actor has claimed the strike. That did not stop the Times of Israel liveblog from running a photo caption describing the vessel as hit “by a reported Iranian drone strike” while the text of the same entry said no party had claimed responsibility. Reuters and Global News both framed Damietta’s importance through its proximity to the Suez Canal, described in their copy as the last remaining safe export route for Saudi oil after Gulf shipments were largely choked off in the Hormuz standoff — a framing that belongs to those outlets, not to any government.

Assessment: Two thresholds were crossed in a day and only one of them was crossed by evidence. Cairo moved from silence on cause to a stated drone finding, which is a real official escalation of the record. Attribution did not move at all, and the gap is where the caption-writing happens: a photo cutline is the cheapest place in a newsroom to assert a culprit, because no editor treats it as a claim requiring a source. Watch whether the Egyptian investigation ever names a party, or whether the file stays permanently at “drone, unattributed” — which suits Cairo, a state with no appetite for being made a belligerent in someone else’s maritime war.

Sources: Reuters via US News — Egypt confirms drone caused fire on two gas vessels at Damietta · The National — Egypt says Damietta port ship fire caused by drone · Al Jazeera — Fire erupts on ships at Egypt’s Damietta port · Global News — Drone hits gas vessel near Suez Canal · Times of Israel liveblog — caption asserting a reported Iranian drone strike

Forty-Three In, Fourteen Signed

Riyadh’s New Maritime Alliance Has No Western Members and No Obligation to Sail

Saudi Arabia announced a Multinational Maritime Defence Alliance for the Bab al-Mandeb on Thursday. The declaration makes participation in operations a sovereign choice, and two wire services cannot agree on who signed it.

The Saudi Ministry of Defence announced the alliance in Riyadh on 30 July at the close of a meeting attended by chiefs of staff or their representatives from 43 countries plus the EU Delegation to Saudi Arabia. Fourteen states confirmed support and issued a joint declaration covering the Bab al-Mandeb, the Red Sea and the Gulf of Aden. The declaration says the alliance “does not target any state, alliance, or international organization,” that “the door remains open for other countries to accede to the coalition’s charter after completing their national procedures,” and — the operative line — that participation in operational activities “will remain a sovereign decision for each member state in accordance with its national laws.” Saudi Arabia is expected to host the headquarters; planners from prospective members are still drafting the charter, command-and-control arrangements and operational framework. This is a declaration of intent, not a standing force.

The signatory list is disputed in the wire copy. Qatar News Agency and The New Arab, citing the Saudi joint statement, list Bahrain, Bangladesh, Djibouti, Egypt, Jordan, Kuwait, Nigeria, Pakistan, Qatar, Saudi Arabia, Somalia, Sudan, Türkiye and Yemen. Anadolu Agency substitutes the Comoros and omits Nigeria and Sudan. Both claim to reproduce the same document. Absent from every version: the United States, the United Kingdom, France, India and China. “Yemen” here means the internationally recognised government — a party to the Yemeni civil war. The Houthis declared a maritime blockade on Saudi Arabia on 20 July and subsequently claimed attacks on Saudi-linked tankers in the Red Sea and on oil infrastructure inside the kingdom.

Assessment: The sovereign-decision clause is what makes this cheap to sign and hard to use. Forty-three states came; fourteen put their names to a document that commits none of them to send a hull. Read alongside the existing Aspides and Prosperity Guardian frameworks, the absence of Washington, London and Paris is the design, not an oversight: Riyadh is building a maritime coalition it can point at without importing an American command structure, at the moment Saudi crude depends on the Bab al-Mandeb because Hormuz is choked. Distrust the membership list until the ministry publishes it. When two state agencies transcribe fourteen names differently, at least one is working from a briefing rather than the paper.

Sources: Qatar News Agency — at least 14 countries announce multinational maritime defence alliance · Anadolu Agency — Saudi Arabia and 13 countries establish coalition for Bab al-Mandab · The New Arab — Saudi sets maritime defence alliance to secure Red Sea · Arabian Business — Saudi Arabia maritime defence alliance · dpa via Yahoo — Saudi Arabia announces military alliance

Two Readings, One Strait

Bloomberg Says Hormuz Traffic Is Up, NBC Says It Fell Back, and the IRGC Names No Ships

On the same morning two wire services read the strait in opposite directions, while Tehran’s account of turning back two tankers omits every verifiable detail.

The IRGC said in a statement on 30 July: “Last night, two oil tankers, encouraged by American aircraft, attempted to leave through the unsafe southern route of the Strait of Hormuz. After a major fire broke out on one of them, both vessels quickly turned back.” The statement, carried by AFP, asserted the strait “cannot be reopened” while US threats persist. As IranWire noted, it omits the tanker names, the location, the cause of the fire and the vessels' flags or owners; no independent corroboration was found. A day earlier the IRGC navy said it had “targeted and stopped” three tankers that ignored warnings — reported by Tasnim, the semi-official agency linked to the IRGC itself, again without names, owners or location. Tehran insists ships use an Iran-designated route, request permission in advance and pay service fees, and rejects the southern route along Oman’s coast. CENTCOM accuses the IRGC of dictating routes and says the passage remains open under US protection.

The traffic data do not agree. Bloomberg reported at 06:55 UTC on 30 July that Hormuz traffic “has picked up in recent days.” NBC News’s vessel tracker, updated 30 July at 10:57 ET, said traffic was “back down following a brief pick-up” and “nowhere near the hundred-plus ships a day that were traversing the strait before the war,” while cautioning that exact numbers may be imprecise. IMF PortWatch data compiled by Statista put average transits at roughly 25 ships a day between late June and early July, against about 100 a day a year earlier. CENTCOM said on 21 July that US forces had assisted the transit of about 900 commercial vessels carrying 450 million barrels of crude — a cumulative self-reported total with no stated start date.

Assessment: Both sides are producing numbers that cannot be audited, for the same reason: whoever controls the perceived risk of the strait controls the insurance premium and the price. The IRGC’s unnamed tankers and CENTCOM’s undated 900-vessel tally are the same instrument pointed in opposite directions. PortWatch is the only figure here with a stated method and sample, and it says the waterway is running at a quarter of normal — which is compatible with both the Bloomberg and NBC readings and is why neither is a lie. Report the disagreement; do not resolve it. And keep the Black Sea attacks on CPC loadings separate: those move the same price, but no reporting ties them to this war.

Sources: AFP via Malay Mail — Oil tankers attempt Hormuz run then turn back after fire, Iran says · IranWire — IRGC says Strait of Hormuz closed to US threats · Bloomberg — Hormuz shipping traffic picks up despite Middle East hostilities · NBC News — Strait of Hormuz port traffic tracker · Statista, citing IMF PortWatch — ship traffic in the Strait of Hormuz · Xinhua — IRGC claim, via Tasnim, of three tankers targeted

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.

The Eight Dead at Kyrnia

Victims of two munitions dropped on a Mopti village on 15 June 2026, by group

Human Rights Watch, 31 July 2026; 19 remote interviews, six of them with witnesses

Geolocated to Its Own Video

Human Rights Watch Traced Africa Corps' Own Footage Back to the Village It Bombed

A report published Friday from Nairobi finds a 15 June airstrike in Mopti killed eight civilians, including three children. The strongest evidence in it is material the Russian unit published itself.

Human Rights Watch reported on 31 July that airstrikes carried out by the Russian government-controlled Africa Corps in central Mali on 15 June killed eight civilians in what it called an apparently unlawful attack. By the organisation’s reconstruction, an aircraft dropped at least two munitions on Kyrnia village in Mopti region that morning. The first struck outside the village chief’s residence, killing two of his children, his wife and another child. The second hit a small cattle market roughly twenty metres away, killing four men. Human Rights Watch said it reviewed a list of names of the eight victims — three children aged one to ten, a 24-year-old woman, and four men aged thirty to forty. Ilaria Allegrozzi, the group’s senior Sahel researcher, said Africa Corps aircraft “have killed civilians in a Malian village in seeming disregard for the laws of war.”

Africa Corps said it struck a “gathering place of terrorist groups” in Mopti that day. Human Rights Watch geolocated footage the group itself released to Kyrnia — the report’s firmest evidentiary link, because it runs against the perpetrator’s own publicity rather than third-party testimony. On the proportionality question, witnesses told the group that about 100 JNIM fighters were in the village at the time, most of them at the mosque, which was not struck; the researchers found no evidence any fighters were killed. Residents said three of the chief’s sons were JNIM fighters but were not in Kyrnia that day. Weaker links: the aircraft was identified as a Sukhoi Su-24 by two Malian military sources — anonymous, and inside the institution being accused — and the findings rest on nineteen remote interviews conducted between 24 June and 14 July, six of them with witnesses.

The strike sits inside a declared campaign. JNIM and the Azawad Liberation Front launched coordinated nationwide attacks in April that killed Mali’s defence minister and hit the country’s main airport; Russia said the following month that its personnel were helping Malian forces retake territory. Kyrnia was bombed on 15 June. The Armed Conflict Location & Event Data Project found that Mali’s military and Russian paramilitary fighters together killed 918 civilians last year, nearly four times the toll attributed to their main Islamist adversaries. Reuters, which carried the report from Dakar, said it could not independently verify the incident. Authorities in Russia and Mali did not immediately comment.

Assessment: Three things are worth separating. The report is confirmed; the underlying event is not independently verified; and the geolocation is the only element that does not depend on witnesses Bamako can dismiss. That makes one item unusually checkable over the weekend — whether the Africa Corps footage stays online. Its removal would be a fact in itself. Allegrozzi’s second line is the structural one: the blank cheque argument makes Bamako liable for sorties it does not fly. Note also what the rebrand cost Moscow. Wagner allowed the Kremlin to disown its own contractors; a formation under the defence ministry cannot be disowned the same way. Mali’s pattern has been to denounce Human Rights Watch rather than investigate. Silence, denunciation and a Russian MoD statement are three different readings of how much reputational cost Bamako thinks it carries.

Sources: Reuters — Russia’s Africa Corps kills Mali civilians in indiscriminate attack, rights group says · Human Rights Watch release text (via Paris Guardian) — Mali: Russia Africa Corps airstrikes kill civilians · News.az — Reuters/APA rewrite of the HRW findings · Africa Defense Forum — Africa Corps accused of atrocities in Mali · Washington Post — HRW’s late-June report on abuses against Fulani communities in Mali

Announced, Not Implemented

Algiers and Bamako Said Three Weeks Ago They Would Send Their Ambassadors Back

The 10 July agreement to reopen airspace and restore envoys ended fifteen months of rupture on paper. Crisis Group’s own summary uses the verb ‘announced'.

On 10 July both governments confirmed they would reopen their airspace and return their ambassadors to post, according to Le Monde as relayed by Maghrebi.org, closing a breach that opened in April 2025 when Algerian air defences downed a Malian military drone near Tinzaouatène on the shared border. The International Crisis Group published Report 256 on 15 July assessing the thaw, and its own framing is careful: “Algiers and Bamako have announced measures to revive bilateral relations, which had deteriorated sharply since 2023.” Announced is not implemented. Nothing in the material available establishes that ambassadors have physically taken up their posts, or that commercial traffic is moving through the reopened corridors. That verification gap is the story until someone closes it.

The border in question is not incidental. The Azawad Liberation Front and JNIM coordinated operations openly for the first time in the 25 April offensive, which followed years of negotiations between them, according to the Critical Threats Project’s Africa File. The same tracker recorded three FLA–JNIM attacks across northern Mali on 4 July, against the military base at Gao and bases at Aguelhok and Anéfis, the last two government-held towns in the Kidal region. AFP reported that wave as coordinated strikes on multiple towns and a prison. Assimi Goïta handed the Alliance of Sahel States chairmanship to Ibrahim Traoré at the December 2025 Bamako summit, which means Ouagadougou, not Bamako, sets the bloc’s diplomatic line for the year in which Mali is repairing relations with Algiers.

Assessment: Read the detente for what each side buys. Algiers recovers a channel into a neighbour whose northern conflict now spills onto its border, without conceding anything on the drone. Bamako gets a diplomatic win it can point to while its air campaign remains flown by a foreign force it does not command — the two tracks do not touch. Distrust the sourcing chain as much as the substance: the confirmation reaches us through an aggregator relaying Le Monde, and the most rigorous account, Crisis Group’s, deliberately stops at ‘announced'. The test is physical. Ambassadors in residence, aircraft in the corridors. Until then this is a communiqué, and communiqués are cheap on both sides of this border.

Sources: International Crisis Group — Report 256, Algérie-Mali: consolider la détente · Maghrebi.org — Algeria and Mali move to restore diplomatic ties · Africa.com — Mali and Algeria restore ties · Critical Threats Project — Africa File on JNIM–FLA coordination and the 4 July attacks · France 24/AFP — Mali hit by new wave of coordinated attacks

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.

Where Sudan's Gold Went in 2025

Destination share of Sudan's recorded gold shipments; the UAE share was 99% in 2024

Sudanese central bank data shared with Bloomberg, 2 April 2026

Fourth Time on the Map

Bara Has Changed Hands at Least Four Times in Ten Months, and the Retreat Ran Through Five Towns

The army’s 26 July recapture of Bara reopened the road to El Obeid. Sudan Tribune reports the withdrawing RSF then attacked civilians in five North Kordofan localities, on unnamed local sources.

The Sudanese Armed Forces General Command announced on Sunday 26 July that its forces had “liberated the three cities by force and with determination following well-planned military operations” — Bara, Jabra al-Sheikh and Umm Sayala — and claimed to have inflicted “heavy losses in lives and equipment” on the Rapid Support Forces, a claim carried by Ahram Online with no figure attached and no independent corroboration. The New Arab added a fourth locality, Umm Qarfa. Geeska noted the operation was run by SAF alongside the Joint Force of allied Darfuri armed movements and other pro-army units, not by army regulars alone. Every account traces to the same General Command statement; none rests on independent verification on the ground. The stated prize is the Omdurman–Bara road, the supply line to besieged El Obeid.

Bara is not a new acquisition. Al Jazeera reported the RSF seizing the town in late October 2025. Sudan Tribune reported the army retaking it on 5 March 2026. Sunday’s announcement is therefore at least the fourth reported change of control in roughly ten months. Inside this week’s window, Sudan Tribune reported from El Obeid on 29 July that a large RSF contingent withdrawing from Umm Sayala, Jabrat al-Sheikh and Bara carried out retaliatory attacks on civilians on Wednesday, naming Um Badr, Sodari, Abu Zaima, Hamrat al-Sheikh and El Mazroub. That account is single-sourced to unnamed local sources, carries no casualty figure, and has drawn no RSF response and no UN confirmation. The Defense Post, with AFP, reported drone strikes on El Obeid on 27 July, after the highway was secured.

Assessment: A corridor is not a supply line and a recapture is not control. The measure of 26 July is not the General Command’s wording but whether food prices in El Obeid move, and whether the town is still in army hands in October. Two things should be held apart: the road reopening, which is announced and plausible, and the reprisal killings, which rest on one outlet’s unnamed local sources and should be labelled as such until OHCHR or a named rights body puts a figure on them. Note also who did the fighting. The Joint Force is a coalition of Darfuri movements with its own war aims, and coalitions bill later.

Sources: Ahram Online — SAF General Command claims recapture of Bara, Jabra al-Sheikh, Umm Sayala · Geeska — Joint Force and pro-army units took part in the North Kordofan operation · The New Arab — army gains framed as possible turning point, fourth locality named · Sudan Tribune — retreating RSF attacked civilians in five North Kordofan localities (29 July, unnamed local sources) · Sudan Tribune — army reported retaking Bara on 5 March 2026 · The Defense Post / AFP — drone strikes on El Obeid after the highway was secured

Letter to the Mediators

Sudan’s Civilian Bloc Wrote to the Quintet to Complain About the Mediators, Not the Belligerents

Somoud spokesman Bakry Eljack says the coalition sent the UN-AU-EU-IGAD-Arab League mechanism critical observations on its methodology and asked for a Sudanese-led process starting with a humanitarian truce.

Bakry Eljack, spokesman for the Somoud coalition, told Sudan Tribune on Tuesday 28 July that the coalition had written to the Quintet mechanism — the United Nations, African Union, European Union, IGAD and the Arab League — setting out critical observations on the current mediation methodology, and proposing instead a Sudanese-led process that prioritises an immediate humanitarian truce. Somoud called for a joint preparatory committee representing the main anti-war coalitions to manage preparations. The Quintet has been trying to bridge divisions among Sudanese political and civic factions over the structure, venue and participants of a proposed peace process. The Somoud statement reached this desk through the Africa Center for Strategic Studies' media review of 29 July, which summarised the Sudan Tribune report; the original has not been read here.

The complaint lands against a parallel track with a poor delivery record. On 3 February, US Senior Advisor for Arab and African Affairs Massad Boulos said the Quad — the United States, UAE, Egypt and Saudi Arabia — had reached a peace document acceptable to both parties, and announced a goal of raising $1.5 billion for Sudan. On 14 July, Sudan Tribune reported the RSF submitting its response to Boulos’s proposals: it accepted a truce while rejecting demands to withdraw. Crisis Group’s April briefing describes the Quad framework as organised around a humanitarian truce, unfettered access, a ceasefire and a political process, and notes that Djibouti, the current IGAD chair, is close to Abdel Fattah al-Burhan while Ethiopia, Kenya and Uganda maintain warm relations with Mohamed Hamdan Dagalo.

Assessment: Civilians attacking the mediators rather than the men with the guns is a reliable signal that they expect to be excluded from the outcome. The interesting content of the Somoud letter is procedural: whoever writes the participant list writes the post-war state, and Somoud is bidding for the pen before the truce, not after. Read the Quad’s February announcement of an agreed document against the RSF’s July refusal to withdraw and the sequence is clear enough — the framework exists, the concessions do not. And as the Africa Center’s own mapping argues, both belligerents are shifting coalitions rather than unified commands, which is why a truce “applying to all forces including affiliates” is a sentence, not a mechanism.

Sources: Africa Center for Strategic Studies — media review of 29 July, summarising Somoud’s letter to the Quintet · Sudan Tribune — RSF submits response to Boulos proposals, accepts truce, rejects withdrawal (14 July) · Sudan Tribune — Boulos says Quad reached acceptable document, announces $1.5bn goal (3 February) · Crisis Group — ‘Divided Sudan, Elusive Peace', Africa Briefing N°211 · Africa Center — ‘Mapping the Armed Actors in the Sudan Conflict'

Two Videos, One Genre

Hemedti Vows to Retake Khartoum on Video Four Days After Losing Ground in Kordofan

The RSF released the recording on 30 July. Its recording date is not established, and the capital has been in army hands since 2025.

Al Jazeera reported on 30 July that the RSF had released a video of Mohamed Hamdan Dagalo telling his forces to seize Khartoum. The recording date is not established. The release came four days after the RSF lost Bara, Jabra al-Sheikh and Umm Sayala, and with its forces nowhere near a capital the army retook in 2025. Al Jazeera’s own framing pairs the video with fighting spreading across North Kordofan. Its counterpart is on the other side: Sudan Tribune reported on 26 July that Burhan had ordered a sweeping offensive to clear the entire country up to the Central African Republic border, a directive announced by a senior military officer who was not named, while Burhan himself addressed troops and supporters at the Military Medical Hospital in Omdurman.

Both statements sit inside a wider pattern of unverifiable battlefield accounting. On 16 July, Sudan Tribune reported the army claiming it had destroyed roughly 205 combat vehicles and supply trucks and four strategic drones in the preceding fortnight — a SAF figure with no corroboration. ACLED, whose Sudan analysts argued on 30 June that logistical realities and historical precedent keep a decisive RSF breakthrough at El Obeid out of reach, has since posted on whether the fall of Bara marks a turning point. Neither party’s declared objective — clearing to the CAR frontier, or marching back into Khartoum — corresponds to any force posture either side has demonstrated this year.

Assessment: Treat both as media artifacts, not intentions. A vow recorded on an unknown date and published the week your lines break is morale management addressed at three audiences: fighters who need paying, foreign patrons who need reassuring, and mediators who need to believe you can still impose costs. Burhan’s hospital speech does the same work in the same week. The tell in each case is the gap between the declared objective and the deliverable — Bara for the army, nothing for the RSF. What to distrust: any outlet that converts either video into a projected offensive, and any tally of destroyed vehicles issued by the side that destroyed them.

Sources: Al Jazeera — RSF video of Hemedti telling forces to seize Khartoum (30 July) · Sudan Tribune — Burhan orders offensive to clear the country to the CAR border (26 July) · Sudan Tribune — army claims 205 vehicles and four drones destroyed in two weeks (16 July) · ACLED — Sudan country page, including ‘Can the RSF seize El Obeid?' (30 June)

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.

Three Passports, One Man

Treasury Says UK-Based, Ynet Says Austrian, FDD Says Egyptian, and No One Has Shown the Document

Eight days after OFAC designated the Muslim Brotherhood’s secretary general, three published versions of his nationality are in circulation and none rests on a passport anyone has seen. The answer decides which European government is on the hook.

The Treasury release of record, sb0572, describes Mahmoud al-Abyari only as a United Kingdom-based senior leader of the Egyptian Muslim Brotherhood and Secretary General of the movement’s General Secretariat, designated on 23 July under E.O. 13224 for acting on behalf of the Egyptian chapter, which OFAC listed as a Specially Designated Global Terrorist in January 2026. Treasury says he supported fundraising for Filistin Vakfi and Hayat Yolu, two Turkey-based organisations already sanctioned over Hamas ties. The Foundation for Defense of Democracies, an advocacy organisation that has campaigned for these designations, calls him a London-based Egyptian national and adds that he edits the movement’s weekly, Risalat al-Ikhwan. Ynet and LBC both describe him as a dual Egyptian-Austrian citizen. Ynet further attributes the asset freeze and travel ban to “the White House” on Thursday, which does not match a Treasury-issued action.

No statement from the General Secretariat answering the designation of its own secretary general has surfaced in eight days. What the movement’s official portal did publish, on Friday 31 July, was a condemnation of the targeting of Egyptian territory and of an explosive-drone attack on a vessel off Damietta governorate — the banned organisation presenting itself as a defender of Egyptian sovereignty. Its most recent statement on the file that OFAC is prosecuting ran on 20 July, three days before the designation: acting General Guide Mahmoud Hussein congratulating Hamas on the election of Khalil al-Hayya, praising the participation of constituencies in Gaza, the West Bank, abroad and in prisons as a practical commitment to “shura practice.” Treasury’s case is that the relationship exists. The Brotherhood asserted it voluntarily, in public, first.

Assessment: The nationality gap is not pedantry, it is jurisdiction. A UK-based Egyptian is Washington acting where London has declined to proscribe. An Austrian citizen is Washington designating a national of an EU member state that has banned Brotherhood symbols since 2021 and would owe an answer of its own. Ynet and LBC are the only outlets making that claim and neither shows documentation; the SDN entry lists nationalities and would settle it. Distrust two other things in the aggregation: Ynet’s White House attribution, and the routine collapsing of SDGT and FTO, which are not the same instrument. Three individuals and one entity from the same action remain unnamed by any outlet.

Sources: US Treasury — press release sb0572 on the 23 July designations · i24NEWS — Treasury sanctions senior Muslim Brotherhood official over Hamas financial networks · Ynetnews — describes al-Abyari as a dual Egyptian-Austrian citizen · LBC — US sanctions London-based Muslim Brotherhood member · FDD — Treasury Extends Its Muslim Brotherhood Campaign to Europe · Ikhwan Online — 31 July statement on the drone attack off Damietta

Renamed, Not Dissolved

Jordan Legislated Its Brotherhood Party Into a New Name, and the First Leadership Vote Is Weeks Away

The Islamic Action Front became Hizb al-Umma on 19 April after 34 years, on the election commission’s order rather than by proscription. Whether that is severance or wrapper turns on a contest two outlets date differently.

Jordan has been closing the Brotherhood by administrative instrument for six years. The Court of Cassation ruled the organisation dissolved on 16 July 2020 for failing to regularise its legal status. On 23 April 2025 the Interior Ministry banned all Brotherhood activity and declared it illegal after the intelligence directorate announced sixteen arrests over an alleged plot; police searched the Islamic Action Front’s Amman headquarters, and a court later sentenced four men to twenty years, per Gulf News. On 25 February 2026 the Independent Election Commission notified the IAF that it must change its name, citing Article 5 of the 2022 Political Parties Law barring parties founded on a religious basis. The party approved the change on 29 March and became Hizb al-Umma on 19 April. Acting Shura Council head Musa al-Wahsh spoke of “wider horizons that accommodate everyone.” CNN Arabic puts the party’s 2024 result at roughly half a million votes and 31 of 138 seats, first among all parties; Al Jazeera’s encyclopedia says 32.

Al-Quds al-Arabi reports that supporters await internal elections at the end of August to choose the new party’s leadership — the first such contest held legally under Independent Election Commission supervision, with voting restricted to formally registered general conference members, and a field the paper describes as mixing hawks and doves. Hafryat, an explicitly counter-Islamist outlet citing unnamed informed sources in Amman and reports carried by Rai al-Youm, says the party moved instead to hold early internal elections in July and calls the exercise a cosmetic operation to circumvent the party law. Neither account has been confirmed and no result has been reported. Washington took the other route on the same chapter: Treasury designated the Jordanian Muslim Brotherhood a Specially Designated Global Terrorist on 13 January 2026, alongside Egypt, for material support to Hamas.

Assessment: Two states are pursuing the same organisation with opposite instruments, and only one of them produces a paper trail that can be litigated. Designation freezes assets and names individuals; Amman’s election-commission route removes the vehicle without ever adjudicating the movement, which is why it has survived four appeals. The test in the next four weeks is not the party’s name but whether Murad al-Adaileh’s network holds the leadership. If it does, the rename is registration hygiene. Distrust Hafryat’s anonymous July timeline, which serves a position, and note that Egypt and Jordan carry SDGT listings only, with no FTO — an asymmetry almost every aggregator erases.

Sources: CNN Arabic — Jordan’s Islamic Action Front becomes the Ummah Party · Al Jazeera encyclopedia — Islamic Action Front entry · Al-Quds al-Arabi — anticipated internal elections within Hizb al-Umma · US State Department — terrorist designations of Muslim Brotherhood chapters, January 2026 · Mada Masr — US designates Muslim Brotherhood in Egypt, Jordan, Lebanon

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.

Sixteen Headlines, Four Positions

How outlets framed the Gaza disarmament announcement, 30–31 July 2026

The Files' count of 16 headlines collected 30–31 July 2026

Three Sequences, One Event

Trump, His Own Board of Peace and Hamas Published Three Different Orders of Operations

The disarmament announcement of July 30 contained three incompatible sequences for who moves first. Of sixteen headlines reviewed, one carried the contradiction.

Trump posted on Truth Social on Thursday evening that his Board of Peace had reached what he called, in capitals, a “HISTORIC agreement for the COMPLETE DISARMAMENT of Hamas and all other armed groups in Gaza.” AP moved the first wire item at 5:43 p.m.; the Washington Post carry is timestamped 9:25 p.m. EDT. Trump’s own text made withdrawal concurrent: “As disarmament is completed, Israeli forces will withdraw, and the International Stabilization Force will work with a new Palestinian police.” The Board of Peace statement carried by CNN the same evening made it sequential: Hamas has committed to relinquishing all its weapons, “which will be followed by Israeli withdrawal from Gaza.” Razi Hamad, a senior Hamas official, told Al Jazeera the reverse: “We will not take any steps regarding disarmament before Israel withdraws from the Gaza Strip.”

Sixteen headlines were reviewed across the window. Seven kept the deal as a claim and Trump as the speaker — AP as carried by the Washington Post and NPR, CNN, Bloomberg, UPI, CBS News and the Washington Times. Four stated it as fact with Hamas as the object: ABC News, Axios, the Jerusalem Post and Fox News, whose headline read “Hamas agrees to complete disarmament under ‘historic' Gaza agreement: Trump.” Four gave Hamas the grammatical subject: AFP as carried by Bangladesh’s BSS, Al Jazeera, Xinhua and a BBC video item retrieved via an aggregator rather than bbc.com and not independently verified. One — Haaretz — put the contradiction above the fold: “Trump Announces ‘Historic' Gaza Deal; Hamas: Disarmament After IDF Withdrawal.”

The gap between headline and body was widest at ABC News, whose headline announced the agreement while its own text said “there was no immediate word from Israeli officials or Hamas on the president’s announcement.” AP’s body carried the same caveat: “Neither Hamas nor Israel gave immediate indication that they had agreed to the deal.” Israel’s position, through Friday, existed only in anonymous form. Ynet reported “Israeli officials” saying Hamas had accepted full disarmament while fearing the formula “could preserve Hamas' influence under a civilian facade.” The Times of Israel liveblog carried an unnamed US official saying Trump would be “very disappointed” if Israel blocked the plan. Israeli Channel 12, relayed through the same liveblog, had White House officials describing Qatari, Egyptian and Turkish pressure on Hamas.

Assessment: The sequencing question is the entire deal, and each party published the version that suits it: Trump needs movement, the Board needs verification before withdrawal, Hamas needs withdrawal before it gives up leverage. An outlet’s choice of headline is therefore a choice of whose sequence to underwrite, made before any party had confirmed anything. Note also the distribution asymmetry — AP’s Trump-as-subject frame reached dozens of American carriers verbatim; AFP’s Hamas-as-subject frame surfaced mainly outside Western markets. And treat both Israeli-outlet leaks as placed: unnamed Israeli officials briefing acceptance, unnamed US officials briefing impatience. Two pressure operations, no event.

Sources: AP via KTVB — Trump announces deal for Hamas to disarm, with Truth Social text · CNN — Board of Peace says disarmament ‘followed by' Israeli withdrawal · Axios — Trump touts ‘historic' agreement; Razi Hamad’s counter-sequence · Haaretz — the only headline carrying both sequences · ABC News — headline asserts the deal, body says no party confirmed it · Ynet — ‘Israeli officials: Hamas has accepted full Gaza disarmament'

The Record in the Slug

Al Jazeera Changed Its Headline Twice in Two Hours and the Original Survives in the URL

Across three outlets on July 30, the published headline and the URL slug disagree. The slugs are the only visible record that the story moved.

Al Jazeera’s live URL for the disarmament story reads `trump-says-board-of-peace-reaches-agreement-on-disarmament-of-hamas-in-gaza` — Trump as subject, “says” as the verb. The displayed headline now reads “Hamas reaches Gaza disarmament agreement with Board of Peace”: Hamas as subject, assertion rather than attribution. An intermediate variant, “Hamas reaches Gaza disarmament agreement with Trump’s Board of Peace,” was captured in an earlier pass. The headline moved at least twice inside two hours as Hamas confirmation firmed up — Xinhua, dateline Cairo, July 31, reported Al Arabiya citing a Hamas official saying a formal statement would follow; AFP, dateline United Nations, reported Hamas agreeing to end the war. The revision tracked the confirmation, which is what revision is for. Only the slug records that it happened.

The same artifact appears on the casualty count. Reuters' Nidal al-Mughrabi filed on the overnight strikes at 2:24 a.m. on July 30, attributing “at least four” killed, including two children, to health officials. The WTAQ carry now headlines four; its slug still reads `israeli-strikes-kill-three-in-gaza`. The slug also reads “amid new ceasefire push”; the headline reads “as new ceasefire push sees progress.” Haaretz, updated 5:01 p.m. IDT, reported six killed and at least 34 wounded, citing medics and Palestinian media. The Palestinian Information Center headlined four and said three in its body, sourced to “a local source.” AP’s own headline differs between carriers: the Washington Post ran “deal for Hamas to disarm in Gaza,” NPR ran the same story without “in Gaza.”

Assessment: None of this is evidence of bad faith. Tolls rise as hospitals report; headlines tighten as confirmation arrives. The problem is that the audit trail exists only by accident, in strings publishers do not update because inbound links would break. A reader arriving at either story on Friday sees a settled fact with no indication it was three things by lunchtime. Watch the Reuters upgrade in particular: “amid” became “as … sees progress,” which moves a strike from coincidence with the diplomacy to counterpoint within it. That is an editorial judgement, not a correction, and it went unmarked.

Sources: Al Jazeera — displayed headline names Hamas; slug preserves ‘Trump says' · Reuters via WTAQ — headline says four killed, slug says three · AP via NPR — same story, headline without ‘in Gaza' · AP via Washington Post — timestamped 9:25 p.m. EDT, July 30 · Xinhua — Hamas official tells Al Arabiya a formal statement will follow

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.

Attribution Without a Name

Five American Outlets Put Iran Behind the Minnesota Water Hack, and No Official Signed It

The preliminary US assessment reported Thursday rests on anonymous officials, the absence of a ransom demand and a reading of tradecraft. Minnesota’s own IT agency has attributed nothing.

The intrusion into operational technology at Minnesota water and wastewater utilities ran overnight from 26 into 27 July. Minnesota IT Services puts the number of affected systems above 30; Valley News Live, citing the New York Times, puts it near 36. Four municipalities have disclosed publicly — Braham, which reported limited reserves and banned lawn watering, Maple Plain, which declared a state of emergency, Plymouth and South St. Paul, whose public works staff told CBS News they moved to manual operation with no effect on treatment, quality, pressure or delivery and no customer data accessed. On Thursday the New York Times, reported by Dustin Volz and Ernesto Londoño, said the preliminary US assessment holds Iranian hackers “probably” responsible. The Washington Post, NBC, CBS and ABC followed within hours. The FBI, EPA and CISA issued a fresh warning to wastewater operators the same day, with CISA saying actors are changing passwords on programmable logic controllers “to lock out operators.”

Every attribution word in print on Thursday came from an unnamed source. NBC’s version rests on a single senior law enforcement official; ABC’s on multiple US officials, all describing the assessment as preliminary and awaiting deeper forensic detail. The two reasons officials gave the Times for leaning Iranian were the tradecraft and the fact that nobody has demanded money. The Times carried its own caveat that hackers could be posing as Iran-based to inflate US–Iran tension, while noting former intelligence officials consider that unlikely. Tenable Research Special Operations pointed at CyberAv3ngers on Wednesday, but that is a vendor inference from operational pattern and timing, not an attribution. MNIT has made none. John Israel, the state’s chief information security officer, said Minnesota has handed material to Washington, “which is evaluating this activity in the broader national context.” Senator Amy Klobuchar requested a briefing Thursday.

Assessment: MNIT did the most useful thing in the file and almost nobody quoted it: the agency told ABC that “impacted” means confirmed malicious activity on a system’s technology, not that any community lost water. That definitional line is a state pre-empting the misreading of its own headline number, and it is the discipline the national coverage abandoned within a day. The event to wait for is a named FBI or ODNI statement; another anonymous briefing is not one. Two things cut against the current read: the forensics are not in, and CyberAv3ngers claim their work. Four days of silence after an operation this size is a data point. Watch instead for a second state — Israel says the activity has likely occurred elsewhere.

Sources: GV Wire (NYT mirror) — US sees Iran as likely behind Minnesota water attack · Washington Post — US spy agencies suspect Iran launched the attack · NBC News — Hallmarks of Iran-backed hackers, one senior official says · ABC News — Investigators probe Iran connection; MNIT defines ‘impacted' · CBS News — South St. Paul moved to manual operation · Valley News Live — Klobuchar briefing request; Israel on evaluation

Eight Days Old

The Advisory Being Shared as Thursday News Was Updated on the Twenty-Second of July

Joint advisory AA26-097A widened the target list to Siemens and Schneider and documented stolen PLC project files. It landed four days before the Minnesota utilities were hit.

AA26-097A was first published in early April 2026 and updated on 22 July by the FBI, CISA, NSA, EPA, the Department of Energy and US Cyber Command. The update did three substantive things. It expanded confirmed vendor scope beyond Rockwell Automation and Allen-Bradley to Schneider Electric’s BMX P34 and Modicon M340 and Siemens' S7-1200. It documented for the first time confirmed exfiltration of PLC project files, carried out using the vendors' own engineering software — Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert and Siemens TIA Portal — run from leased third-party infrastructure. And it added detection guidance for tampering with Add-On Instructions, the reusable code modules inside PLC programs. The advisory records manipulation of HMI and SCADA displays causing operational disruption and financial loss, with added logic overriding instruction sets that had maintained safe operating parameters. CISA’s headline mitigation remains the simplest one: disconnect controllers from the public internet.

Infosecurity Magazine published on the advisory on 30 July and it is circulating as news of that day. TechCrunch covered it on 23 July, as did SecurityWeek and TechTimes. The genuinely new federal item on 30 July was the separate FBI, EPA and CISA warning to wastewater operators, not the advisory behind it. The number worth carrying is the interval: Tenable and The Register both place four days between the 22 July update and the 26 July intrusion in Minnesota. Underneath sits CVE-2021-22681, an authentication bypass in Rockwell Logix controllers rated 9.8, disclosed in February 2021, with no vendor patch, added to CISA’s Known Exploited Vulnerabilities catalogue only in March 2026. For historical scale, the 2023–24 Unitronics campaign compromised 75 controllers.

Assessment: Search-engine freshness signals are misdating a great deal of this week’s cyber reading, and the advisory is the clearest case: a federal document eight days old is being read as a same-day response to Minnesota, which inverts the sequence and flatters the warning. Two figures travelling through this story should not be charted yet. The 5,200 internet-exposed Rockwell controllers globally and 3,900 in the United States are attributed to Censys via a secondary write-up, and Tenable’s estimate that roughly 60 affiliated pro-Iranian groups have absorbed CyberAv3ngers techniques is likewise reaching readers second-hand. Neither primary publication has been read. A vendor inference repeated three times is still a vendor inference.

Sources: CISA — Joint advisory AA26-097A · IC3 — Advisory PDF, dated 22 July 2026 · Infosecurity Magazine — Siemens and Schneider added to scope · TechCrunch (23 July) — US government on disruption of water and energy providers · Tenable — Coordinated attack on Minnesota water utilities: what you need to know · The Register — CyberAv3ngers suspected in Minnesota attacks

Watch Tomorrow — The Files' Forward Radar

Iran File: Whether the Saudi Ministry of Defence publishes the signatory list itself — QNA’s version has Nigeria and Sudan, Anadolu’s has the Comoros and neither — and whether any party claims the Damietta strike.
Sahel Monitor: Whether the Africa Corps footage that Human Rights Watch geolocated to Kyrnia is still online on Saturday, and whether Bamako or the Russian defence ministry says anything at all about the 15 June strike.
Sudan Crisis Monitor: Whether Sudan Tribune’s single-sourced account of RSF reprisals at Um Badr, Sodari, Abu Zaima, Hamrat al-Sheikh and El Mazroub acquires a second source, a casualty figure or an OHCHR line.
The Brotherhood Brief: Whether the OFAC SDN entry for Mahmoud al-Abyari lists Austrian nationality alongside Egyptian, and whether Vienna, the Home Office or the Brotherhood’s own General Secretariat responds at all.
Western Media Watch: Whether any Israeli official responds to the disarmament agreement on the record, or whether every ‘Israel accepts' line stays anonymous and routed through Israeli outlets.
Digital Front Monitor: Whether the FBI or ODNI puts a name and a signature to the Minnesota water intrusion, whether a second state discloses similar activity, and whether CyberAv3ngers breaks its silence and claims it.