MEFILES — Daily Intelligence on the Region's Hard Questions

Iran File — Lead

CENTCOM Disabled Two Vessels the Day Trump Called a Hormuz Deal Imminent; No Government Has Published a Text

For the second time in eight weeks, a strike on Iran was announced and then called off, and both cancellations were explained by an agreement only Washington describes. The only negotiation either side confirms is between Iran and Oman, and it is about managing transits, not ending a war. Enforcement in the Strait of Hormuz ran straight through the diplomacy: US Central Command says it disabled two vessels and boarded two more on Monday. The framework the reopening is meant to rest on exists publicly only because two outlets printed it from anonymous disclosure.

MEfiles · Iran File · August 4, 2026

The strait, by the record

What is documented on 3 August, against what is announced

157

Days of war logged to 3 August

Vessels CENTCOM says it disabled

Vessels CENTCOM says it boarded

Governments that have published the MOU text

GlobalSecurity.org OPREP Day 157; US Central Command via Haaretz, 3 Aug 2026; NPR, 18 June 2026

The sequence is now on the record from both capitals and they do not match. Trump announced late on 1 August that he had called off what he described as the largest planned US operation since the Second World War, telling reporters aboard Air Force One the next day that talks would begin Monday afternoon and that a deal covering Hormuz and denuclearisation was imminent, as carried by Bloomberg and Fox News. On Monday morning Iranian foreign ministry spokesman Esmaeil Baghaei said at a press conference, in remarks quoted by CNN: “We currently have no negotiations with the United States; the negotiations are with Oman,” adding that they would not lead automatically to a reopening of the strait. Trump did not retreat. At an unrelated executive-order signing he said talks were “going on right now” and that “for some reason, when they’re talking, they don’t like saying that they’re talking” (TIME), before calling Iran’s leadership “unbelievably duplicitous” (CNN). Later on Monday, CBS News reported that US officials — unnamed, and therefore contradicting their own president on background — said no new negotiations with Iran were planned.

What continued while the two accounts diverged is the enforcement. Haaretz’s Monday live file quotes US Central Command’s own account on X that American forces “disabled two vessels and boarded two others as part of enforcement operations” and “continue to strictly enforce the U.S. blockade against Iran.” GlobalSecurity.org’s daily operational summary, logging 3 August as day 157 of the war, records that while missile and drone exchanges paused, what continued was enforcement in the strait, citing the IRGC-affiliated Fars agency. Statista’s tracking note on Hormuz traffic refers to Iran attacking two tankers attempting a mined route. That last word is the load-bearing one. If mines remain in the channel, the reopening Trump describes as imminent is a minesweeping operation measured in weeks, conducted by navies currently blockading and being fired on, not an event that follows a signature. No party has published a clearance plan, a timetable, or a figure for mines laid or cleared. A claim circulating that the IRGC struck tankers under active US air cover rests on a single consumer-technology outlet and is not used here.

The paper trail is thinner than the announcements. The framework being invoked is a memorandum of understanding signed by Trump and President Masoud Pezeshkian with Pakistan’s prime minister as mediator; its text is public only because NPR published it on 18 June from a source who spoke anonymously and was not authorised to discuss it, and because Arab Center Washington DC printed a parallel copy sourced to a senior US official. Neither government has released an official version. Foreign Minister Abbas Araghchi’s standing formula for it, on 29 June, was “commitment for commitment.” The precedent for Sunday’s cancellation is 11 June, when Trump said the US would hit Iran “VERY HARD TONIGHT” and would be “taking Kharg Island, and other oil infrastructure points,” then cancelled hours later citing approval of the “final points” of an agreement, per CNN’s own log. Two cancellations, two explanations, one document nobody has officially issued. Reuters, alone among the wires reviewed, put Iran’s statement in the main clause: no talks with Washington, talks with Oman on management of the strait.

}],

Assessment: Read the incentives rather than the adjectives. Trump needs a live deal to justify standing down twice without a strike; Tehran needs the transit question open and bilateral talks deniable, because a mediated conversation about managing passage costs it nothing at home and concedes no legitimacy. Muscat gains from being indispensable and invisible, which is why it appears in Reuters, Al Jazeera and Iranian copy and in almost no US headline. Distrust three things today. First, any sentence in which “the deal” covers both shipping and the nuclear file: only Washington describes one negotiation. Second, anonymous officials on both sides — CBS’s unnamed US officials contradicting the president are as unverifiable as Iranian sources telling wires nothing is planned. Third, any reopening timeline that does not address the mines; a signature does not clear a channel. The checkable question nobody has answered on the record is whether Iran intends to charge for passage rather than restore free transit. Until someone asks it in public, “reopening” is a word doing work no navy has done.

Sources: Bloomberg — Trump says talks are Iran’s last chance after strikes scrubbed · CNN live file — Trump calls Iranian leadership ‘unbelievably duplicitous' after Tehran denies talks; Baghaei quote · Reuters via Spokesman-Review — Iran says Hormuz talks ongoing after Trump calls off strikes · Haaretz live file — CENTCOM says it disabled two vessels and boarded two others · CBS News live file — US officials tell CBS no new negotiations with Iran are planned · NPR — full text of the US–Iran memorandum of understanding, from an anonymous source · Al Jazeera — Iran says negotiations with Oman over Strait of Hormuz in final stages · GlobalSecurity.org — Iran War daily OPREP, Day 157, 3 August 2026

The Cartoon — August 4

“The barrier lifts on signature. The mines are a separate contract.”

MEFILES · the cartoon · US Central Command says it disabled two vessels and boarded two more on the day Trump called a Hormuz deal imminent

157

days of war logged on the Iran file by 3 August, with strait enforcement continuing through the diplomacy

GlobalSecurity.org daily operational summary, 3 August 2026

killed when drones struck a tribal court sitting under a tree in RSF-held North Darfur; one monitor is the source for every wire version

Emergency Lawyers, via AP, AFP and Al Jazeera, 2 August 2026

civilians Human Rights Watch says Africa Corps aircraft killed at Kyrnia, Mopti, on 15 June; no Malian or Russian response has surfaced

Human Rights Watch investigation, 31 July 2026, based on a list of eight named victims

days between the Senate Brotherhood hearing’s postponed May listing and tomorrow’s, which still has no witness list posted

Senate Judiciary Committee hearing calendar

30+

Minnesota water and wastewater facilities whose control systems were targeted on 26–27 July; the FBI says at least seven states and names none

Minnesota IT Services via CBS News; SecurityWeek

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.

Second Cancellation

Trump Has Now Called Off a Strike on Iran Twice and Explained Both With a Deal Only He Describes

The 2 August cancellation was announced as progress toward an agreement. Within a day the President was calling Iran’s leadership “unbelievably duplicitous,” and CNN’s own blog records the same sequence playing out on 11 June.

The sequence is documented across four days. On Friday 31 July CNN reported that the United States “announced plans to strike Iran as soon as this weekend, according to two US officials,” who cautioned that “the precise scope of the strikes and potential targets were unclear” and that the operation “could be called off.” On Sunday 2 August Trump cancelled it, saying deal “perimeters” had been reached — the phrasing Al Jazeera carried as its headline of record. By Monday the posture had inverted. CNN’s live blog: “Less than 24 hours after voicing optimism a deal was close to reopen the Strait of Hormuz, President Donald Trump swung back to lashing out against the Iranian regime.” Its headline records him calling Iran’s leadership “unbelievably duplicitous.” From the Oval Office, per the Washington Times: “Nothing gets through to Iran, unless we want it to, and nothing will get through, unless a Deal, or Total Surrender, is accomplished.”

The same CNN blog records the precedent. On 11 June Trump said the United States would hit Iran “VERY HARD TONIGHT,” adding it would “be taking Kharg Island, and other oil infrastructure points” — then cancelled hours later, saying “final points” of an agreement had been approved. Two announcements, two cancellations, two explanations resting on the President’s account of a negotiation nobody else has described in the same terms. There is no independent confirmation that a strike package was ever loaded in either case. RFE/RL’s framing of the scrubbed operation as the “Biggest Attack Since WWII” is Trump’s own characterisation relayed, not an assessment by anyone with access to the target list. ABC’s live page headlines the “last chance” line alongside a threat of “decapitation”; that word appears in the headline and we could not verify it in the text beneath.

Assessment: An announcement that can be withdrawn is cheap leverage, and it has now been spent twice in eight weeks. The first use bought a claim of approved “final points”; the second bought “perimeters.” Neither produced a document. The cost is that the threat depreciates: Tehran has watched two cancellations and moved its public position not at all. Watch what the reversal is aimed at. Monday’s language — total surrender, duplicity — is the vocabulary of a negotiator preparing to explain why the deal he promised did not arrive, and it is aimed at an American audience as much as an Iranian one.

Sources: CNN live blog — Trump swings back after voicing optimism, calls Iranian leadership “unbelievably duplicitous” · CNN live blog — US announced plans to strike Iran as soon as this weekend, per two US officials · Washington Times — Trump gives Iran “last chance” to make a deal to end the war · Bloomberg — Trump says talks are Iran’s last chance after strikes scrubbed · ABC News live updates — Iran, Trump, Oman · GlobalSecurity — Iran war daily operational summary and source list

Enforcement Through Diplomacy

The Strait Being Reopened by Signature Is Still Mined, and Enforcement Ran All Through the Talks

GlobalSecurity’s Day 157 summary records that the missile and drone exchanges paused while enforcement in the strait did not. If the mines are still in place, reopening Hormuz is a minesweeping operation with a timeline, not a document.

GlobalSecurity’s daily operational summary for Day 157 records that while the missile and drone exchanges paused over 2–3 August, “what continued was enforcement in the strait,” citing the IRGC-affiliated Fars agency. Around 30 July the IRGC claimed its naval forces targeted and halted three oil tankers in the Gulf — reported by IranWire, a diaspora outlet critical of the Iranian government, and resting on the IRGC’s own announcement. On 31 July the technology outlet Tech Times reported that the IRGC struck two tankers travelling under active US air cover; that is a consumer technology site reporting a naval engagement, and we have not seen it confirmed by CENTCOM, UKMTO or a wire. Statista’s chart note on Hormuz traffic, dated within the last fortnight, records that the United States “resumed its blockade of the shipping route last week, while Iran attacked two tankers trying to slip through a mined route with missiles.”

The word doing the work in that sentence is “mined.” A blockade can be lifted in an afternoon and a fee schedule can be signed in one; a minefield in a shipping channel takes weeks of hull-by-hull clearance before underwriters will price a transit. The US naval blockade has been running since 13 April. The Hormuz campaign was framed as an operation to reopen the passage by destroying the Iranian naval vessels and drones targeting shipping, and Israel assassinated IRGC Navy commander Alireza Tangsiri in its course. The mediated track is narrower than the announcements around it: Bloomberg’s summary is that “Iran denied it was negotiating with the US, but said talks with Oman to get more ships moving through the Strait of Hormuz are making progress.” CNN reported on 30 June, citing a regional source with knowledge of the negotiations, that Oman is not pushing for a fee-based system and that US negotiators had concerns about the Omani proposal.

Assessment: The measurable test of any Hormuz agreement is not a signing but a clearance operation: who sweeps, on whose hulls, under whose escort, and when war-risk premiums come down. Until someone names that operation, “reopening” is a claim about intent. Distrust the tanker-strike reporting in both directions — the IRGC’s own claims travel through outlets with a stake in them, and a technology site is not a source for a missile engagement under US escort. But the trend line is sourced independently of any of them: enforcement did not pause when the strike did.

Sources: GlobalSecurity — Day 157 operational summary, enforcement in the strait continued · IranWire — IRGC says it targeted three tankers in the Persian Gulf · Tech Times — IRGC fires on US-escorted tankers, air-only Hormuz strategy shows its limit · Statista — Ship traffic in the Strait of Hormuz, chart note on the resumed blockade and mined route · CNN — Oman is not pushing for a fee-based system in the strait, per regional source · Bloomberg — Iran denies negotiating with the US, cites progress with Oman on shipping

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.

The AES force, as stated

Joint force headquartered in Niamey: claimed current strength against announced target

Attributed to Nigerien President Abdourahamane Tiani, reported by Pravda Niger, 26 July 2026 — Russian state-aligned, unverified against AES communiqués

Claimed as an Achievement

A Russian-Aligned Site Says Mali Bombed a Hospital, and Files It Under Successes

Pravda Mali, part of the Russian-aligned news-pravda network, published items on 2 and 3 August presenting a Shahed strike on a Tin Zaouatine medical facility and an Africa Corps air raid in Mopti as operational wins. Neither claim is independently confirmed; both are being advertised rather than reported.

The first item, headed to the effect that the Malian Air Force “continues to destroy medical centers where wounded militants are being treated,” states that a Shahed strike hit a hospital in Tin Zaouatine where, it says, a large number of illegal gold miners were also being treated. The outlet’s weekly roundup dated 3 August lists a separate line: “Russian Africa Corps Aviation Strikes Large FLA-JNIM Coalition Camp in Mali’s Mopti Region.” Neither item carries a casualty figure, a date for the strike itself, or any indication of who was in the building. Pravda Mali sits inside a Russian state-aligned network; nothing in either post has been matched by a wire agency, by the Malian armed forces' own communiqués as retrieved, or by an independent monitor. The claims are artifacts of a publicity operation, not established events.

What makes them worth logging is the corroboration they offer against their own side’s interest. The Critical Threats Project’s Africa File recorded the first use of Shahed-style Geran drones in Mali at Anéfis on 4 July, and dated Russia’s first shipment of Gerans to Mali to May 2026. The same tracker reported six days of fighting at Anéfis, one of the last two government-held towns in the Kidal region, with FLA-JNIM besieging FAMA and Africa Corps troops in an encircled camp, and a Malian army claim of more than 300 insurgents killed in 54 airstrikes between 6 and 8 July — an army claim, not a verified count. Mopti is also where Human Rights Watch, on 31 July, placed an Africa Corps strike that killed eight civilians at Kyrnia on 15 June, including three children aged one to ten. Ilaria Allegrozzi, HRW’s senior Sahel researcher, said the aircraft “killed civilians in a Malian village in seeming disregard for the laws of war.”

Assessment: The asymmetry is the finding. Moscow’s Mali channel has published nothing answering Kyrnia four days after HRW named the victims, and inside the same week promoted a strike on a hospital as a success. That is a choice about audience: the readership being served rewards demonstrated reach, not compliance with the laws of war, and the network is pricing atrocity denial as more costly than atrocity advertisement. Distrust the Tin Zaouatine claim itself — a strike promoted by an interested party with no date, no toll and no independent witness may not have occurred as described, or at all. What the posts do establish is that the Geran deployment CTP dated to May is now being marketed, and that Mopti is the air campaign’s centre of gravity.

Sources: Pravda Mali — claims Shahed strike on Tin Zaouatine medical facility · Pravda Mali — weekly roundup listing Africa Corps strike in Mopti · Human Rights Watch — Africa Corps airstrikes kill eight civilians at Kyrnia · Al Jazeera — HRW says Africa Corps killed Mali civilians in air strike · Critical Threats Project — Africa File on Anéfis, FLA-JNIM and Geran drones · Reuters via US News — rights group calls Mali strikes indiscriminate

Doha Turned Down

Algeria Rejected Qatari Mediation With Bamako, Then Reopened Its Airspace Without a Joint Text

International Crisis Group’s 15 July report on the Algiers–Bamako thaw records that Algerian authorities refused several mediation attempts, Qatar’s among them, before settling the rupture bilaterally. The Gulf’s Sahel portfolio was declined at the door.

Crisis Group Report N°256, “Algérie-Mali : consolider la détente,” published 15 July, dates the break in the freeze to 10 July, when Algiers and Bamako announced through separate communiqués the return of their respective ambassadors and the reopening of their airspaces to each other’s civil and military aircraft — the report cites Le Monde of 11 July. The separate texts are the detail worth holding: neither capital would put its name to a joint one. The rupture had followed a drone incident on the border in 2025, after which Mali closed its airspace to Algeria “by reciprocity” in April 2025, per Jeune Afrique of 8 April 2025 in Crisis Group’s footnotes. Algeria had already returned its ambassador to Niger in February 2026, ending a break of nearly ten months.

On the mediation, Crisis Group rests on its own interviews with Algerian diplomats in Algiers in October 2025 — anonymous, and the report says so. Those diplomats feared the drone row would produce a lasting rupture; Algerian authorities, per the same interviews, rejected several mediation attempts, including by Qatar, long present in Mali in finance and humanitarian sectors, and by Niger, and cut direct contact with Malian leaders. Crisis Group, citing Sahel Tribune of 17 February 2026, attributes to General Abdourahamane Tiani the line that “no Algerian, no African could understand Algeria lending its territory to attack an African country” — second-hand through a regional outlet. Follow-through is thinner: the reported reception of Algerian Ambassador Kamal Retieb by Malian Foreign Minister Abdoulaye Diop on 20 July comes via Pravda Mali, a Russian-aligned outlet.

Assessment: Read from the Gulf, the refusal matters more than the reconciliation. Doha has spent years building a Sahel presence through finance and humanitarian channels precisely so it can convert access into mediation, as it has in Kabul, Gaza and eastern Congo. Algiers declined the offer and then closed the file itself, which is a statement that the Sahel’s northern border is a North African problem and not a brokerage market. Distrust the sequencing: Crisis Group’s account of the refusals rests on anonymous diplomats speaking nine months before the thaw, and the timing of Bamako’s own softening — arriving as JNIM and the FLA pressed Kidal region — suggests necessity did more work than diplomacy.

Sources: International Crisis Group — Algérie-Mali : consolider la détente (Report N°256) · Crisis Group — full report PDF with sourcing footnotes · Institute for Security Studies — Algeria’s return to the Sahel · Agence Ecofin — what the resumption of Algeria–Mali relations reveals · Pravda Mali — reports Retieb received by Diop on 20 July (partisan)

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.

Sudan's hunger figures, and the gap

Current authoritative caseloads, plus the population the IPC says it cannot classify

IPC Sudan special snapshot, Feb 2026–Jan 2027; UNICEF, 15 May 2026

The Army’s Drone File

A Tribal Court Sitting Under a Tree in North Darfur, Thirty-Five Dead, One Monitor

Emergency Lawyers says Sudanese army drones hit a customary court in RSF-held North Darfur on Sunday. Every wire account rests on that one group, and the army has said nothing at all.

Drones struck the headquarters of a civil court in a village in North Darfur at about 1:00pm local time (1100 GMT) on Sunday 2 August, according to Emergency Lawyers, a Sudanese monitoring group. The village is under Rapid Support Forces control and the strike is attributed to the Sudanese Armed Forces. Emergency Lawyers put the toll at at least 35 killed and dozens injured, the figure carried by AP, AFP, Al Jazeera, Middle East Eye and The National. Sudan Tribune reported at least 37, sourced to an eyewitness it spoke to directly rather than to the monitor, and is the only outlet to place the village in Kabkabiya locality. The village name appears in four transliterations across the coverage — Al-Zawiya Gara, Garra al-Zawaya, Ghara al-Zawiya, Ghurra Zawia. They are one incident, not four.

Al Jazeera describes the target as a traditional institution for resolving local and tribal feuds, and reports that the session was being held outdoors, under a tree, with local community participation; the court building was also damaged. Emergency Lawyers says the victims were inside the building and its immediate surroundings, per Middle East Eye. AFP’s copy notes the group has documented abuses by both the army and the paramilitaries across the three-year war — it is not a partisan monitor. No SAF statement, denial or acknowledgement appears in any of the retrieved reporting, and the RSF has not commented either. Sudan Tribune frames the strike as part of intensified army drone operations across Darfur following RSF battlefield losses in North Kordofan; that is the outlet’s own analysis, not a sourced claim.

Assessment: For eighteen months the Sudanese drone story has been RSF quadcopters over El Obeid and Port Sudan, and the reporting infrastructure has been built around it. The army’s fleet operating the same way over RSF-held civilian space is covered thinner and slower, and here it is carried entirely by one monitoring group. Distrust any account that merges 35 and 37 into a single figure, and note that CFR’s tracker attributes 37 to Emergency Lawyers, which the wires do not. The most durable fact in the file is the army’s silence: not a denial, not a claim of a military target, nothing to contest.

Sources: Al Jazeera — Sudan army drone attack on Darfur court kills 35, rights group says · Sudan Tribune — at least 37 killed, eyewitness account, Kabkabiya locality · Middle East Eye — victims inside the court building and its surroundings · The National — at least 35 killed in drone strike on North Darfur court · EWN/AFP — Emergency Lawyers has documented abuses by both sides · CFR Global Conflict Tracker — Sudan power struggle entry

What Arrives, Not Who Holds

Plan International Called El Obeid Near-Catastrophe Six Days After the Army Said Its Road Was Open

The Al Sadarat highway was announced as a second supply line into El Obeid on 26 July. On 1 August an INGO put the city’s drinking-water gap at about 70 percent.

Plan International said on 1 August that the humanitarian situation in El Obeid, capital of North Kordofan, was close to becoming a catastrophe because of the spread of cholera amid acute shortages of food and drinking water. The statement was carried by the Saudi Press Agency and by Sudan Tribune’s Arabic service, which put the city’s drinking-water gap at around 70 percent. Neither carried a cholera case count. Roughly 500,000 people are described as trapped in the city, a figure used consistently by Al Jazeera in July and by Saudi Gazette. UNFPA’s flash update of 2 July recorded near-daily drone attacks on El Obeid “as part of a sustained campaign to impose siege-like conditions on the city,” systematically targeting power substations, fuel stations, water facilities and healthcare infrastructure. Six days before Plan’s statement, the army announced complete control of the Omdurman–El Obeid export road, which Saudi Gazette said opened a second supply route into the city.

That announcement was contested at the time. Local sources cited by Radio Dabanga, carried by allAfrica, disputed that the route had reopened and said fighting continued along key sections. Sudan Tribune reported on 1 August that the army was consolidating along the road “despite intense drone attacks by the Rapid Support Forces,” quoting a field commander in Bara — about 60km north of El Obeid — who said there was “no room for a paramilitary return,” and an officer at Um Qirfa who ruled out further losses on the route. The same Sudan Tribune report described the army finding Bara “a ghost town as its entire population fled after RSF control.” On 30 July the RSF released video of Mohamed Hamdan Dagalo telling fighters, per The National: “Think of Khartoum! We promise all our people from this spot that our target is Khartoum.” In the same address he offered new recruits wages backdated to April 2023 and rebuked fighters for location posts he called “intelligence gifts.”

Assessment: A supply road is tested by tonnage, not by press statements, and nobody on either side of this file has published a convoy count, a fuel volume or a water-truck figure for El Obeid since the highway was declared open. The only quantified number out of the city this month measures an absence. Two readings survive: the corridor is held but not yet functioning as logistics, or it is less held than announced — Dabanga’s local sources said the second on 27 July and have not been answered. Bara’s reported emptying is the unnumbered story underneath both. Hemedti’s backdated wages read as a liquidity and recruitment signal to his own ranks, not as a Khartoum plan.

Sources: Sudan Tribune (Arabic) — Plan International on El Obeid; ~70% drinking-water gap · UNFPA — Flash update on the situation in El Obeid, 2 July 2026 · Saudi Gazette — army says it wrested the Khartoum–El Obeid highway · allAfrica/Radio Dabanga — local sources dispute that the route reopened · Sudan Tribune — army consolidates along export road; Bara ‘a ghost town' · The National — RSF chief tells fighters Khartoum is the target after setback

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.

Chapters designated since November

Cumulative Muslim Brotherhood chapters designated under Executive Order 14362

US Department of State and US Treasury press releases, 24 Nov 2025 – 4 Aug 2026

Seventy-Seven Days Later

The Senate’s Brotherhood Hearing Sits on Tomorrow’s Calendar With No Witness List Posted

The Judiciary subcommittee has re-listed “Hidden in Plain Sight” for 2:30pm Wednesday in Dirksen 226. As of this sweep the page carried no witnesses, no opening statements, and one line: check back for live video.

The Senate Judiciary Subcommittee on Federal Courts, Oversight, Agency Action, and Federal Rights lists a hearing titled “Hidden in Plain Sight: Confronting the Muslim Brotherhood Network in America” for 05/08/26 at 2:30pm in Dirksen Senate Office Building Room 226. It is the same title the subcommittee carried for 20 May 2026, which appears on both the upcoming-hearings and past-hearings pages with the prefix POSTPONED — seventy-seven days of slippage on the committee’s own calendar. The committee’s records do not agree with themselves on the original: the calendar entry gives 05/20/26 at 2:30pm, while the dedicated May hearing page describes a meeting “on May 20, 2026 at 10:30 AM.” The August page, at the time of checking, listed no witnesses and no submitted statements.

The trade coverage of the re-listing is thin and circular. Legis1, in a piece dated around 1 August under the headline “Senate Panel Will Examine Muslim Brotherhood’s U.S. Operations,” places the hearing inside a wider push by some Republican members for federal scrutiny of Muslim organisations, and records that civil-rights and interfaith groups have objected that the effort risks conflating Muslim religious and civic activity with support for terrorism. That is Legis1’s characterisation; no named critic appears on the record in it. En.ImArabic’s 1 August write-up is built explicitly on the Legis1 report — aggregation of aggregation, and not an independent confirmation of anything.

Assessment: The title does the work the calendar won’t: “Network in America” is a domestic frame, and everything Washington has actually designated under Executive Order 14362 sits abroad. So the witness list is not colour, it is the whole question — an oversight panel reviewing the January and March tranches looks nothing like a panel built to argue for designating US-based entities. Distrust the aggregators here; two outlets reporting the same Legis1 snippet is one outlet. And note the base rate: this hearing has already been pulled once. A second postponement would be the more informative outcome.

Sources: Senate Judiciary Committee — August 5, 2026 hearing listing · Senate Judiciary Committee — the postponed May 20 listing · Senate Judiciary Committee — upcoming hearings calendar · Legis1 — Senate panel will examine Muslim Brotherhood’s U.S. operations · En.ImArabic — the Brotherhood before Congress (built on the Legis1 report)

One Fragment, No Docket

A Truncated Snippet Says Treasury Sanctioned Brotherhood Fundraising in July; No Primary Record Confirms It

The only trace of a fourth designation round is half a sentence in an aggregator. There are no entity names, no jurisdictions, no dollar figures — and until OFAC says otherwise, the count still stands at four chapters.

The Legis1 piece on the Senate hearing contains the fragment “The Treasury Department said its July sanctions exposed fundraising networks in whi—”, cut off in the search return. If a July 2026 OFAC action exists, it would be the first round after the two on the record: on 13 January 2026 State designated the Lebanese Muslim Brotherhood, also known as al-Jamaa al-Islamiyah, as both a Foreign Terrorist Organization and a Specially Designated Global Terrorist, and its secretary general Muhammad Fawzi Taqqosh as an SDGT, while Treasury designated the Egyptian and Jordanian chapters as SDGTs for material support to Hamas; on 9 March State added the Sudanese Muslim Brotherhood. Four chapters, one individual. No OFAC Recent Actions page, Treasury press release or Federal Register entry for July 2026 was retrievable in this sweep. A second page on the same theme, dated around 30 July at theworkersrights.com, is not an outlet this desk would source.

The asymmetry inside the January tranche is the part most coverage flattens. Only Lebanon carries the FTO label, which brings criminal material-support exposure; Egypt and Jordan carry SDGT only, which blocks assets. That gap is exactly what the Foundation for Defense of Democracies has been arguing about since 16 January, when it published that the Jordan designation “needs to be strengthened.” The authority for all of it is Executive Order 14362, signed 24 November 2025 and printed at 90 Federal Register 55033, whose Section 3(a) gave State and Treasury thirty days to report jointly to the President on which chapters to designate. Secondary literature has repeatedly mis-rendered the order as 13462, including the Immigration Policy Tracking Project.

Assessment: Half a sentence in an aggregator is not a sanctions action, and the distance between them is the point of this desk. The cheap version of this story writes the July tranche into existence and inherits an error nobody can trace; the honest version notes that a finance-focused round, if real, is the first test of whether the money track reaches beyond the Middle East. Watch two things Wednesday: whether a witness cites July sanctions from the chair, which would make the claim official without making it verifiable, and whether the FDD argument for upgrading Jordan and Egypt to FTO arrives via testimony after six months as a think-tank campaign.

Sources: Legis1 — the truncated reference to July Treasury sanctions · US State Department — terrorist designations of Muslim Brotherhood chapters, 13 January 2026 · US Treasury — press release sb0357 on the Egyptian and Jordanian chapters · US State Department — designation of the Sudanese Muslim Brotherhood, 9 March 2026 · Federal Register — Executive Order 14362, 28 November 2025 · FDD — the US designation of Jordan’s Muslim Brotherhood needs to be strengthened

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.

Who names Oman in headlines

Headlines on the 2–3 August talks dispute, by whether the confirmed mediator appears

The Files, counting twelve headlines retrieved 2–3 August 2026 (Bloomberg x3, CBS x2, ABC, Fox, AP via Washington Post, AP via PBS; Reuters via Spokesman-Review, Al Jazeera, IranWire)

One Wire, Two Verbs

The Same AP Story Ran as “Says” in the Post and “Claims” at PBS Hours Later

A single Cairo-datelined wire story about Trump’s Iran talks was published under two different levels of scepticism on Monday, and the copy underneath barely changed. Two CBS live files carried opposite propositions the same day.

The Associated Press filed from Cairo on 3 August. The Washington Post carried it at 5:53 a.m. EDT as “Trump says talks on Iran war will begin on Monday after he holds off on ‘massive' strikes.” PBS NewsHour carried the same wire later that day as “Trump claims Iran talks will start Monday, and other developments in the Middle East.” The body text is the one AP wrote: “After calling off a fresh round of strikes against Iran, U.S. President Donald Trump announced that new talks to wind down the war would start Monday, even as Iranian officials claimed their diplomatic efforts were focused on” — and there the retrieved excerpt ends. Note the direction of scepticism inside the paragraph: “announced” for Trump, “claimed” for the Iranians, the exact reverse of what the PBS headline does. The PBS URL slug still reads “and-4-other-developments” against a headline that says only “other developments.”

The Post’s own staff copy, timestamped 5:54 a.m. EDT — one minute after the wire version it was also hosting — ran the sceptical construction: “Iran rejects Trump’s claim that talks will restart, adding to weekend of whiplash,” under the standfirst “The U.S. president said late Sunday that he had called off ‘the biggest attack since WWII' so that talks could resume. Iran said Monday that no talks were planned.” That story’s URL slug preserves the earlier posture: trump-cancels-iran-attack-citing-progress-deal-tehran-israel-alert. CBS News ran both propositions as separate live files. One, updated 4:27 a.m. EDT on 3 August: “U.S.-Iran negotiations set to begin Monday, Trump says after calling off strikes.” The other, later the same day: “Despite Trump’s remarks, no new negotiations with Iran are planned, U.S. officials tell CBS News.” No reconciliation between the two files is visible on either page.

Assessment: The correction travelled through the verbs, not the reporting. Nobody added a fact between “says” and “claims”; a desk editor simply decided how much distance to buy. That makes the URL slug the only durable record of what an outlet thought first, and it is now the third slug artefact in this window. Treat the load-bearing element of the CBS reversal with care: unnamed US officials contradicting their own president is a real fact about Washington, but it is anonymous and single-outlet, and CBS never says whether the second file supersedes the first. TIME’s flat pairing — “Iran Denies Talks With the U.S. Are Back On. Trump Insists They Are” — required no rewrite because it adjudicated nothing.

Sources: Washington Post (AP wire) — “Trump says talks on Iran war will begin on Monday” · PBS NewsHour (same AP wire) — “Trump claims Iran talks will start Monday” · Washington Post staff — “Iran rejects Trump’s claim that talks will restart” · CBS News — “U.S.-Iran negotiations set to begin Monday, Trump says” · CBS News — “no new negotiations with Iran are planned, U.S. officials tell CBS News” · TIME — “Iran Denies Talks With the U.S. Are Back On. Trump Insists They Are”

The Missing Mediator

Nine American Headlines Covered a Negotiation Whose Only Confirmed Party Is Oman

Iran’s foreign ministry said on Monday that it is talking to Muscat, not Washington. In the US wire and network headlines reviewed, Oman does not appear once; Gulf states appear as petitioners.

At a Monday press conference, Iranian foreign ministry spokesman Esmaeil Baghaei said, as quoted by CNN: “We currently have no negotiations with the United States; the negotiations are with Oman.” He added that those talks would not lead automatically to a reopening of the strait. He had already drawn that line on 2 August, telling reporters — per IranWire, a diaspora outlet adversarial to Tehran — that any Iran–Oman agreement on a new maritime route has no connection to whether the Strait of Hormuz opens or stays closed. Reuters, carried by the Spokesman-Review, was the only wire in the retrieved set to put Iran in the subject position: “Iran says Hormuz talks ongoing after Trump calls off strikes,” with a lede specifying no negotiations with the United States and talks with Oman on management of the strait. Al Jazeera reported on 2 August that the Oman negotiations were in “final stages.”

Across the nine US wire and network items retrieved for the same 36 hours — three Bloomberg headlines, two CBS live files, ABC, Fox News Digital and the AP wire in two syndications — Oman is named in none. Gulf capitals enter only as supplicants: Bloomberg wrote that Trump called off the attack “partially in response to pleas from US allies in the Middle East, including Saudi Arabia”; ABC that “Trump said he called off the strikes after appeals from regional leaders.” Trump himself did not retreat, telling reporters at an unrelated executive-order signing on Monday that talks are “going on right now” and that “for some reason, when they’re talking, they don’t like saying that they’re talking.” He also called Iran’s leadership “unbelievably duplicitous,” per CBS, and told CNN he faced no time constraints because he is not seeking reelection.

Assessment: The specialist tracker GlobalSecurity.org managed in one line what no major headline attempted: “Both statements can be literally true.” A US–Oman–Iran relay is not a US–Iran negotiation, and a maritime-route arrangement is not a Hormuz reopening. Distrust the two Iranian framings equally — “final stages” and “no connection” cannot both be doing the work their publishers want. The structural point is the grammar of agency: Washington acts, Riyadh pleads, Muscat is invisible even when it is the only party either side confirms is at a table. Read from the Gulf, that is the mediator being written out of its own mediation.

Sources: CNN — Baghaei says negotiations are with Oman, not the US · Reuters via Spokesman-Review — “Iran says Hormuz talks ongoing after Trump calls off strikes” · IranWire — “Baghaei: No Talks With the US; Negotiations Are Exclusively With Oman” · Al Jazeera — “Iran says negotiations with Oman over Strait of Hormuz in final stages” · Bloomberg — Trump called off attack partly over Gulf “pleas” · GlobalSecurity.org — Day 157 update: “Both statements can be literally true”

Whose Injury Is It

Two Israeli Papers Made Monday’s Gaza Strikes a Story About the Board of Peace

Haaretz and the Times of Israel both framed the day’s strikes as defiance of a diplomatic body. In one headline the dead are a subordinate clause; in the other they are absent.

Haaretz’s live file on 3 August ran under “Live Updates | Despite Board of Peace Urging De-escalation, IDF Strikes in Gaza Kill Two.” Its body reported that the Israeli army launched artillery shelling and tank fire across multiple areas of the Strip, including eastern Khan Yunis and the Al-Bureij refugee camp in the central Strip, attributing this to unnamed “Palestinian sources.” The Times of Israel’s file the same day: “Israel said to strike Gaza for first time in a day, defying Board of Peace pressure to halt fire.” Both construct the story as Israel versus a diplomatic mechanism rather than Israel versus Palestinians; the casualty figure survives as Haaretz’s final clause and does not appear in the Times of Israel headline at all. Two days earlier, Al Jazeera reported seven killed across Gaza and a medicine warehouse destroyed in Deir el-Balah, sourced to the Gaza Health Ministry.

The Jerusalem Post’s 3 August live file supplied the window’s clearest example of a belligerent’s claim entering a newspaper’s own voice. It identified “Palestinian Islamic Jihad (PIJ) terrorist, Mahmoud Fatair, a Nukhba commander in the PIJ’s Central Gaza Brigade who infiltrated Israel on October 7th and took part in holding Rom Braslavski hostage,” with the photo credited to the IDF Spokesperson Unit — the sole source for the identification, the affiliation and the alleged conduct. No independent verification appears on the page. That is a claim about a killing, not a confirmed killing, and “terrorist” is the Post’s word, not an attributed one. The same Post live file also carried, on “reportedly,” a line that Israel intended to join the now-cancelled US attack on Iran, without an originating outlet.

Assessment: When the offended party in a headline is a diplomatic board rather than the people under shelling, the story’s subject quietly becomes the durability of a process. That framing is useful to everyone: it lets Israeli outlets report the strikes without contesting them, and lets the Board of Peace appear as the aggrieved authority in a war it is not fighting. Two sourcing floors are worth marking — unnamed “Palestinian sources” in Haaretz and the IDF Spokesperson Unit alone in the Jerusalem Post. Neither is disqualifying; both are single-channel. As in the Iran cluster, the day’s contested element is not the event but the vocabulary chosen to carry it.

Sources: Haaretz — “Despite Board of Peace Urging De-escalation, IDF Strikes in Gaza Kill Two” · Times of Israel — “Israel said to strike Gaza… defying Board of Peace pressure to halt fire” · Jerusalem Post — live file identifying a PIJ commander via the IDF Spokesperson Unit · Al Jazeera — strikes kill seven, medical supply warehouse destroyed in Deir el-Balah

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.

Firing Without the Power

Katz Announced a General’s Removal on Channel 14, and the IDF Reversed Him Within the Hour

Defence Minister Israel Katz used a live interview on the pro-government network to replace the army’s West Bank commander over a restraining order against a settler. The military said he lacks the authority, and by Monday Katz called the story a “complete lie.”

On Sunday night, 2 August, Katz told Channel 14 that he was replacing Maj. Gen. Avi Bluth, chief of Central Command and the army’s senior officer for the West Bank, and named a successor on air. According to the Times of Israel, the IDF “quickly put out a sharp statement saying Bluth… would remain in his post,” praising the general and stating that the announcement was “not coordinated” with Chief of Staff Lt. Gen. Eyal Zamir — and that “the defense minister does not have the authority to unilaterally fire Bluth.” The IDF Spokesperson’s Unit added that Zamir “has no intention of replacing commanders in key positions during this sensitive period.” Katz’s stated grievance was specific: per ToI, Bluth “had contravened his policy by seeking to renew an administrative restraining order against a violent settler,” Tal Yinon Dardik, whom ToI describes as suspected in a brutal March attack at Khirbet Humsa. The Jerusalem Post’s account of the same interview has Katz accusing Bluth of being “overly harsh” on settler violence while “neglecting the fight against Palestinian terrorism.”

By Monday Katz called the reported dismissal a “complete lie” and said Bluth is “performing his duties well” — while also claiming, per ToI, that Zamir had himself wanted Bluth replaced. That claim is Katz’s, relayed in part through “sources close to Katz,” and Zamir has not confirmed it in anything the brief captured. The alignment did not fall where the framing predicted. ToI’s Jeremy Sharon reports that settlement leaders “strongly criticize” Katz over the attempted removal; Katz met West Bank mayors and regional council heads on 3 August in a photograph distributed by his own ministry. Bluth has separately been “lambasted by left-wing groups” for a lax response to settler violence, per ToI. An opposition liveblog headline called the episode “an unprecedented lowpoint,” and ToI records both “opposition, allies call to oust Katz.” Channel 13 reported, without naming its sources, that Netanyahu called Katz’s conduct “obscene behavior.”

The durable consequence is procedural. ToI reports that Zamir on Monday “reportedly decided to freeze senior appointments in the military to protect the army from political interference, until at least after the general election that is set for October 27” — a companion subhead states it flatly, but the sourcing is Israeli-media relay, not an on-record IDF statement. ToI supplies the detail that makes the freeze nearly costless: most general staff roles run three to five years, “meaning that no officers will be required to stay on longer than usual if Zamir holds off on appointments until 2027.”

Assessment: Note the choice of venue. Katz went to Channel 14, the network whose own polling — per JNS — has put the coalition at up to 65 seats while mainstream surveys keep it in the low-to-mid 50s. That is an announcement made to a friendly audience rather than through the chain of command, which is why the walk-back arrived within a day. Two things to distrust: Katz’s assertion that Zamir wanted Bluth gone, which rests on his own account and unnamed associates; and the appointments freeze itself, still hedged with “reportedly” by the outlet reporting it. The tell worth watching is the settlement leaders' position. When the people the minister said he was protecting side with the general he tried to remove, the fight is about who commands, not about the settler.

Sources: Times of Israel — Katz announces he’s replacing top West Bank general; IDF says he’ll stay · Times of Israel — Katz tries to walk back on-air removal as opposition, allies call to oust him · Times of Israel — Katz now says Bluth is doing well, isn’t ousted · Times of Israel liveblog — IDF says Katz does not have the authority · Times of Israel liveblog — Settlement leaders back West Bank commander after attempted ouster · Jerusalem Post — Katz accuses Bluth of being overly harsh on settler violence

Anonymous Distance

Herzog Praises the Disarmament Deal While an Unnamed Israeli Official Says It Doesn’t Reflect Israel’s Position

The Board of Peace’s envoy says his team is working around the clock to de-escalate and that Israel was briefed “extensively.” Israeli strikes continued through the same three days, counted by three different standards.

Times of Israel reporting by Jacob Magid and Lazar Berman on 3 August carries Board of Peace envoy Nickolay Mladenov lamenting recent Gaza strikes, saying the team is “working around the clock to de-escalate,” while a Board official says Israel was briefed “extensively” as the Hamas disarmament agreement came together. Against that, an Israeli official — unnamed in ToI’s own summary — says the agreement “does not reflect” Israel’s stance, and President Isaac Herzog lauds “positive elements” in it. The gap is the story: the head of state on the record welcoming a deal that an anonymous official is simultaneously distancing the government from. The agreement Trump announced on Truth Social on 30 July claimed “COMPLETE DISARMAMENT of Hamas and all other armed groups in Gaza,” with Israeli withdrawal proceeding “as disarmament is completed” in “carefully structured phases.”

The strike tally over the same window arrives with three different provenances, and the Israeli press flags the difference itself. Haaretz’s live headline for 1–2 August reads “Reports: six killed, including a child, in a wave of Israeli strikes across Gaza” — Haaretz’s own word is “reports.” Just Security’s 3 August summary of wire reporting puts the 2 August toll at “at least 18 Palestinians,” attributed to medics, with strikes on Gaza City, Deir al-Balah and Khan Younis and described as the biggest daily death toll in weeks; that figure is sourced to medics, not to a ministry and not to the IDF. By 3 August Haaretz was running “Despite Board of Peace Urging De-escalation, IDF Strikes in Gaza Kill Two.” Al Jazeera’s summary of the terms notes that no weapons are to be handed to Israel or any non-Palestinian body, with a National Committee as sole holder.

Assessment: An unnamed official distancing the government from a deal the president welcomes is a common Israeli manoeuvre in an election season: it preserves the coalition’s right flank without rejecting Washington’s initiative outright. Read the anonymity as the message rather than the leak. The casualty numbers deserve the same care — 18 from medics, six from “reports,” two from Haaretz’s own live desk are not a trend line, and stacking them would manufacture one. What is verifiable is that Mladenov’s envoy office is publicly lamenting strikes by a party it says it briefed extensively, which is an admission that the sequencing in Article-style phased withdrawal is not being observed on the ground.

Sources: Haaretz live — Reports: six killed, including a child, in Israeli strikes across Gaza · Just Security Early Edition, 3 August — at least 18 killed, per medics · Haaretz live — Despite Board of Peace urging de-escalation, IDF strikes kill two · Axios — Trump announces Board of Peace disarmament agreement · Al Jazeera — What we know about the Gaza disarmament agreement · Times of Israel — Israel and the region index

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.

Attribution Gap

The FBI Says Seven States, Names None, and Every Iran Link Runs Through Anonymous Officials

A joint FBI-EPA-CISA warning on 30 July described degraded water operations at US utilities. The Iranian authorship being reported around it has not been stated on the record by any agency.

Minnesota disclosed in the week of 27 July that operational-technology systems at more than 30 water and wastewater facilities had been targeted. SecurityWeek dates the intrusions to 26 and 27 July, notes only a handful of cities issued public statements, and reports one city briefly took its water plant down while most reported no operational impact. CBS News, citing Minnesota IT Services, reports most confirmed Minnesota cases involved technology used to remotely monitor and control water equipment, including programmable logic controllers. On Thursday 30 July the FBI, EPA and CISA issued a public service announcement. NBC News describes it as reporting incidents to the FBI with some malicious activity degrading water operations, and notes the announcement does not name the states. CBS reports the agencies warned of internet-exposed industrial controllers, and that in at least some cases federal authorities reported loss of monitoring and control functionality, leading to pressure loss and flooding.

The scope figure and the attribution move in opposite directions. CBS: “The FBI reported incidents in ‘at least seven states' but didn’t identify them.” Michigan joined Minnesota on Saturday; SecurityWeek names Michigan, South Dakota and Georgia as reportedly on the list, sourced to media reporting rather than official confirmation. Four of the seven remain unidentified. Against that, CBS reports its sources cautioned that they had not definitively attributed the attack, that their assessment could change as technical evidence is collected, and that they are probing whether the actor could have attempted to appear Iran-based as a way of stirring the pot amid the ongoing US conflict with Iran. NBC attributes the “hallmarks of Iranian meddling” characterisation to a single law enforcement official. The Yahoo wire aggregation reports officials telling The New York Times that the water attacks have not been definitively declared to have come from Iran, and that criminal hackers are less likely because there is no financial motive.

The public evidence carrying the Iran frame is three years old. CBS notes federal agencies previously confirmed that actors affiliated with Iran’s Islamic Revolutionary Guard Corps used a similar playbook in 2023, accessing multiple water and wastewater facilities by exploiting internet-connected controllers that retained default passwords. CISA’s current release, quoted by Yahoo News on 2 August, says threat actors targeting exposed PLCs “have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses,” activity that “has resulted in boil-water notices and sustained manual operations.” No jurisdiction has been named as issuing such a notice. Dale George, communications director at Michigan’s Department of Environment, Great Lakes and Energy, told CBS the state received “a small number of reports from Michigan communities indicating activity consistent with what federal agencies described,” and that “All systems continued to operate safely, issues were addressed by local operators, and there are no known impacts that posed a public health concern.” Minnesota IT Services said on 30 July there was no indication the breaches contaminated any municipal water supply.

Assessment: Read the sequence, not the headline. A CISA advisory numbered AA26-097A dates to early April; NBC dates a CISA/FBI advisory on Tehran-linked attempts against automated infrastructure devices to 22 July; the intrusions follow on 26–27 July; the PSA lands on 30 July. Outlets are compressing four documents into one event, and some indexes are timestamping the April advisory as two weeks old. The load-bearing caveat is the one CBS put in writing: its own sources are testing whether someone wanted to look Iranian. In a week when Washington is describing Hormuz as closed, a false flag is cheap and the incentive to accept one is high on both ends. Watch for the first on-the-record attribution, or a formal refusal.

Sources: CBS News — US investigating Iran link to Minnesota water system cyberattacks · NBC News — Hackers targeted municipal water systems in 7 states, FBI says · SecurityWeek — US water cyberattacks extend beyond Minnesota to at least six other states · Yahoo News — Cyberattacks on water systems spread to 7 states · CISA — Advisory AA26-097A, Iranian-affiliated actors exploiting PLCs · Nextgov — Pro-Iran hackers targeting US industrial control systems (7 April 2026)

Attribution From The Podium

Trump Blamed Minnesota for the Water Attacks While His Own Agencies Declined to Blame Anyone

At a Cabinet meeting on Friday, the president said “I think that Minnesota is behind it.” The FBI, EPA and CISA had issued their warning the day before without naming a state or an actor.

The Yahoo News aggregation of Friday 31 July reports President Donald Trump blaming Minnesota and Governor Tim Walz for the attacks, quoting him directly: “I think that Minnesota is behind it.” The remark came a day after the FBI, EPA and CISA public service announcement that NBC News notes does not name the states involved, and while, per CBS News, federal sources were cautioning that no definitive attribution had been made and were examining whether the actor had tried to appear Iran-based. Minnesota is the jurisdiction that disclosed the intrusions in the first place: more than 30 water and wastewater facilities with OT systems targeted on 26 and 27 July, per SecurityWeek and CBS citing Minnesota IT Services, with the state’s IT agency saying on 30 July there was no indication any municipal water supply had been contaminated.

The infrastructure numbers around the story are firmer than the attribution. SecurityWeek reports that days before the Minnesota attacks, federal agencies updated their April advisory to warn that industrial control systems made by Siemens, Schneider Electric and Rockwell Automation had been targeted — three named vendors. SecurityWeek also cites Censys counting roughly 10,000 Rockwell, Siemens and Schneider Electric PLCs exposed to the internet, while noting it is unclear how many are actually vulnerable; that is a snapshot, not a trend. CISA’s release, via Yahoo News, says it is “observing a significant increase in cyber threat actors targeting programmable logic controllers” in the water and wastewater sector. The remediation instruction is to take the devices off the public internet — a measurable action, unlike the question of who touched them.

Assessment: Two competing attributions now sit on the same file: an unnamed foreign state, sourced to background officials, and a domestic governor, sourced to the president on camera. Neither is evidence. What matters is which one the agencies bend toward. If CISA or FBI messaging starts accommodating the Minnesota line, the technical record becomes unusable for anyone outside the United States trying to assess whether Iranian OT operations are real and escalating — which is precisely the judgement Gulf utilities and CERTs need to make. No Iranian denial or acknowledgement has been located. Tehran’s silence past 72 hours is itself worth logging, because Iranian state media has been quick to claim less consequential things.

Sources: Yahoo News — Cyberattacks on water systems spread to 7 states; Trump blames Minnesota · NBC News — FBI announcement does not name the states · SecurityWeek — Advisory update names Siemens, Schneider Electric, Rockwell; Censys exposure count · CBS News — Sources say attribution not definitive, false-flag possibility under examination · TechCrunch — US government says Iran-linked hackers are disrupting American water and energy providers (23 July)

Watch Tomorrow — The Files' Forward Radar

Iran File: Whether any party puts a minesweeping timetable or a transit-fee position on the record, and whether CENTCOM logs further boardings after Monday’s “last chance” framing.
Sahel Monitor: Whether Bamako or the Russian Ministry of Defence answers Human Rights Watch’s 31 July Kyrnia findings, five days after publication, and whether any outlet confirms the 100-JNIM-fighters qualifier against the HRW original.
Sudan Crisis Monitor: Whether the SAF acknowledges or denies the 2 August strike on the Al-Zawiya court, and whether Plan International, WHO or OCHA publishes an actual cholera case count for El Obeid to go with the 70 percent water gap.
The Brotherhood Brief: At 2:30pm in Dirksen 226: whether the hearing holds after its 20 May postponement, and whether a witness list is posted before the gavel.
Western Media Watch: Whether PBS keeps “claims” in the AP headline while the Washington Post keeps “says”, and whether any US wire or network puts Oman in a headline for the first time.
Israel Press Review: Whether the IDF Spokesperson’s Unit confirms on the record that Chief of Staff Eyal Zamir has frozen senior appointments until after the 27 October election, a claim so far carried only as “reportedly”.
Digital Front Monitor: Whether the FBI names any of the seven states or attributes the water-utility intrusions on the record, and whether Tehran says anything at all after four days of silence.