MEFILES — Daily Intelligence on the Region's Hard Questions

Iran File — Lead

Iran and Oman Agreed Coordinates for One Exit While the Houthis Spent the Same Week Closing the Other

Tehran says a route through Hormuz has been fixed on a map; Washington says a deal is 48 hours away; Qatar says drafts are moving and nothing is on the books. On Wednesday the Houthis said they had hit a Saudi tanker off Yanbu, at the top of the sea Saudi Arabia started using when Hormuz shut. Neither corridor has a published text. The only instrument that has committed anything in writing is the Brent forward curve, and it is in backwardation.

MEfiles · Iran File · August 6, 2026

The curve prices a reopening

Brent futures settlement by contract month, 6 August 2026 intraday

Oilprice.com futures board, 6 August 2026, 06:08

Iranian Foreign Ministry spokesman Esmaeil Baghaei said on Wednesday that Iran and Oman had agreed the geographic coordinates of a shipping route through the Strait of Hormuz, and that a joint announcement was being finalised “provided no third parties interfere” — reported by Bloomberg, Euronews and MarineLink from the same briefing. In the same remarks he said the agreement could not guarantee safe navigation while “the US naval blockade and other actions against Iran and its interests remain in place.” That is an announced coordinate set, not a reopened strait. What the arrangement contains is described only by anonymous or interested parties: Reuters, in copy this desk read only in summary, attributed a Tehran-controlled entry regime to one senior Iranian source and two regional officials; Israel Hayom, a partisan Israeli daily attributing to “reports,” describes the two existing lanes merged into a single two-way corridor. Iranian state television calls it a “middle corridor” run by the two countries, and a second state outlet says it will not immediately reopen the waterway and has “nothing to do with the United States.” President Trump told reporters more would be announced “in 48 hours.” Qatar’s Majed Al Ansari said on Tuesday only that “the efforts are still ongoing with all the parties.”

Twenty-four hours before Baghaei spoke, Houthi military spokesman Brigadier Yahya Saree said in a video statement that the group had struck the Saudi tanker Wafa with ballistic missiles in the northern Red Sea off Yanbu, and would “escalate in targeting Saudi oil tankers in the northern Red Sea to close all access points and prevent their passage.” Gulf News reported the group claimed two Saudi tankers, the eighth and ninth since the blockade began. There is no Saudi military or maritime confirmation; The War Zone said explicitly that it could not verify the claim. The placement is not stable across outlets either — CNN’s live file put a claimed strike on a different Saudi tanker in the Gulf of Aden on the same day, while Bloomberg carried the northern Red Sea threat. The mechanics behind the claim are not in dispute. With Hormuz closed, Yanbu became the kingdom’s principal crude export terminal and Bab al-Mandeb its critical transit corridor; Gulf News, citing maritime tracking data whose provider it did not name in the copy reviewed, reported Saudi seaborne crude via Bab al-Mandeb rose eightfold between March and mid-July against the same period in 2025.

The market has taken a position where the governments have not. Brent settled at $79.26 on Tuesday after losses of roughly five percent in each of the two preceding sessions, which TradingEconomics attributed to optimism about a Hormuz reopening; it traded at $80.28 on Thursday morning, up 1.13 percent, down 10.13 percent over five days and up 9.89 percent over the month. The forward curve on Thursday read $80.28 for October, $78.71 for November, $77.42 for December and $76.44 for January — steep backwardation, a war premium the market expects to decay. Physical traffic is less confident. Lloyd’s List Intelligence recorded 84 transits in the week to 2 August against 45 the week before, preliminary; a second series on the same page reads 52 against 28, and the page does not say what distinguishes them. NBC’s tracker, updated Wednesday, has traffic “back down following a brief pick-up.” Baghaei’s coordinates, if published, would fix a line on a chart. They would not tell a shipowner who is charging, who is escorting, or what happens at the other end of the Red Sea.

Assessment: The reopening story is being told as a single negotiation with a variable number of participants. Tehran says it is talking to Muscat and not to Washington; Washington says talks are live; Doha says drafts circulate and no direct meeting is scheduled. Those are not three angles on one process — they may be three processes, and the discrepancy is the reporting, not noise to be smoothed. Distrust, in order: any account of the deal’s content, all of which currently rests on anonymous sources on one side of the table; the Houthi tanker claims, which no operator, navy or maritime authority has confirmed and which three outlets placed in two different seas inside a day; and the Lloyd’s transit numbers until someone defines the two series. The deeper point is one no headline this week carried. Reopening Hormuz on Iranian and Omani terms does not restore Saudi optionality if the Red Sea exit is contested. It leaves the kingdom with two routes, each priced by somebody who does not sell oil.

Sources: Bloomberg — Iran says agreement on Hormuz shipping route reached with Oman · Euronews — Baghaei says route agreed, warns deal cannot guarantee navigation safety · Bloomberg — Houthis say they will target tankers in the northern Red Sea · Gulf News — Houthis claim eighth and ninth Saudi tankers since the blockade began · The War Zone — Houthis to expand shipping attacks to northern Red Sea; claim unverified · ABC News — Trump says more Iran detail in 48 hours · Xinhua — Qatar’s Majed Al Ansari on ongoing efforts and no scheduled direct talks · Oilprice.com — Brent futures and forward curve, 6 August

The Cartoon — August 6

“Two exits, and neither key is ours.”

MEFILES · the cartoon · Iran and Oman say they have fixed coordinates through Hormuz; the Houthis say they will close the northern Red Sea

8×

Increase in Saudi seaborne crude moving through Bab al-Mandeb after Hormuz closed — the route now being targeted

Gulf News, citing maritime tracking data (provider unnamed in the copy reviewed); March–mid-July 2026 vs 2025

12%

Resupply rate Bamako reported in the same briefing as 807 tanker trucks and 36.95 million litres in one week

Malijet, reporting Industry and Trade Minister Moussa Alassane Diallo, week to 30 July 2026

$100m

Value of bullion said to have reached the UAE from Sudan’s central bank and state refinery — a theft-of-state claim, not a conflict-mineral one

Financial Times investigation, read via Semafor’s summary, 4 August 2026

Dutch MPs in a 150-seat chamber who backed a non-binding motion to ban the Brotherhood; no legal theory of what a ban attaches to has been published

EU Reporter / JNS, motion adopted 20 March 2026

US states with reported intrusions into water utilities, up from seven in six days; only five have been named publicly

ABC News count via SecurityWeek, 5 August 2026

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.

Hormuz transits, week on week

Recorded transits, week to 26 July vs week to 2 August 2026; figures preliminary

Lloyd's List Intelligence, Strait of Hormuz Brief, 5 August 2026. A second series on the same page reads 28 to 52; the page does not define the difference

Priced, Not Signed

The Brent Curve Is the Only Party That Has Committed Anything to Hormuz in Writing

Iran, Qatar and Washington each described a different process on Wednesday. The futures market described one process, and put a date on it.

Iranian Foreign Ministry spokesman Esmaeil Baghaei said on 5 August that Iran and Oman had agreed the geographic coordinates of a shipping route through the Strait of Hormuz, and that a joint announcement was “being finalised, provided no third parties interfere.” In the same remarks, carried by Euronews, he said the arrangement could not guarantee safe navigation while “the US naval blockade and other actions against Iran and its interests remain in place.” Iranian state television called it a “middle corridor” controlled by the two countries; a second Iranian state outlet said the deal would not immediately reopen the strait and that the negotiations “have nothing to do with the United States.” NBC reports Iran denies holding talks with Washington at all. Trump told reporters more detail would come “in 48 hours,” adding: “But we are talking. Let’s see what happens.”

Then there is the price screen, which is the only participant publishing numbers. Brent settled at $81.77 on 4 August, down 2.07 per cent, and at $79.26 on 5 August, after losses of roughly 5 per cent in each of the two preceding sessions that TradingEconomics attributed to optimism about a reopening. At 06:08 on 6 August, Oilprice.com showed October Brent at $80.28, up 1.13 per cent, with the five-day move at −10.13 per cent and the one-month move still +9.89 per cent. The forward curve on the same page runs October $80.28, November $78.71, December $77.42, January $76.44 — steep backwardation. Lloyd’s List Intelligence’s 5 August brief reports 84 transits for 27 July to 2 August, up from 45, and, on the same page, 52 up from 28, without stating which vessels each series counts. NBC’s tracker, updated 5 August, says traffic is “back down following a brief pick-up.”

What the corridor actually contains is still sourced to people who will not be named. Reuters reported that the arrangement would give Tehran control over ships entering the Gulf, citing a senior Iranian source and two regional officials, and characterised this as one of the largest concessions yet to Iran; this desk retrieved that reporting only through MarineLink’s summary. Israel Hayom describes the merger of the northern Iranian lane and the southern Omani lane into a single two-way corridor under Iranian oversight, but attributes it to “reports” rather than its own sourcing. Axios’s account of a 60-day interim, toll-free reopening involving Washington, Tehran and Muscat reached us secondhand, through market commentary. Vice President JD Vance, at a congressional roundtable on Wednesday, said the talks would “be messy” and that “the Iranians are extraordinarily difficult people” with “a fractured system.”

Assessment: Backwardation is not a verdict. A curve that decays $3.84 from October to January can just as easily price near-term physical tightness in a mined waterway as it can price a signature; traders are hedging cargo they cannot move, not endorsing a text. Note also that the two loudest descriptions of the deal’s contents — Iranian supervision of Gulf entries, and a toll-free American-blessed interim — flatter opposite constituencies, and neither has been read by anyone on the record. The tell to watch is not the announcement but the June memorandum both sides claim to be implementing. Until someone publishes it, Tehran and Washington can keep describing the same paper as two different agreements.

Sources: Bloomberg — Iran says Hormuz shipping route agreement reached with Oman · Euronews — Iran and Oman agree route for ships in Strait of Hormuz, Tehran says · MarineLink — Iran, Oman agree coordinates of Hormuz route · ABC News — Trump live updates: ‘I’d rather make a deal because I don’t want to kill people' · CNN — Vance says Iran talks will ‘be messy' · Oilprice.com — Brent futures curve, 6 August

Blockade for Blockade

Saudi Crude Went North to Escape the Houthis, and the Houthis Went North After It

Yahya Saree says ballistic missiles hit the tanker Wafa off Yanbu. No Saudi authority has confirmed it, and Yanbu is now the kingdom’s main way out.

Houthi military spokesman Brigadier Yahya Saree said in a video statement on 5 August that the group had “successfully targeted the Saudi oil tanker ‘Wafa' in the northern Red Sea, off the coast of Yanbu, with a number of ballistic missiles.” He said the existing blockade had pushed Saudi Arabia to divert “its oil tankers towards the northern Red Sea,” and that the group would “escalate in targeting Saudi oil tankers in the northern Red Sea to close all access points and prevent their passage.” Gulf News reports the Houthis claimed two Saudi tankers, describing them as the eighth and ninth targeted since the blockade began. Wafa is a chemical and product tanker built in 2014. The Washington Times reported no immediate comment from Saudi military or maritime authorities; TWZ said it could not independently verify the claim. Tehran Times, which is Iranian state-aligned, renders the rationale as “blockade for blockade” and says Saree wrote on X that the missiles hit “accurately.”

The geography is the point. With Hormuz closed since February, Yanbu has become Saudi Arabia’s principal crude export terminal and Bab al-Mandeb its critical transit corridor — a shift documented across Gulf News, Kurdistan24 and Daily Sabah. Gulf News, citing maritime tracking data whose provider was not named in the copy this desk retrieved, reports Saudi seaborne crude exports via Bab al-Mandeb rose eightfold between March and mid-July 2026 against the same window in 2025. The southern blockade moved the cargo north; the missiles have now followed. CENTCOM posted material on 4 August that we have not read. A claim that an Indian-flagged vessel sank off Yemen on 4 August with all fourteen crew rescued is circulating on an aggregator with no confirmation from the Indian Navy, DG Shipping or UKMTO, and we are not treating it as an event.

Assessment: Nine claimed hulls, none independently confirmed, is a pattern that rewards the claimant either way: unverified claims raise war-risk premiums on Saudi cargo at no cost, and a denial from Riyadh would only publish the route. Watch insurance quotes and Yanbu loading data rather than statements. The connection to the Hormuz track is uncomfortable for the kingdom. If the strait reopens on a corridor whose coordinates two other coastal states have set and which Tehran expects to supervise, Saudi Arabia trades a northern exit under missile fire for a southern one it does not administer. Nobody in Muscat or Washington has said where that leaves Riyadh.

Sources: Bloomberg — Houthis say they will target tankers in northern Red Sea · Gulf News — Houthis say they attacked Saudi oil tanker in the Red Sea · Washington Times — Houthis strike Saudi-flagged oil tanker in Red Sea · TWZ — Houthis to expand shipping attacks to northern Red Sea · Oman Observer — Saudi oil tanker attacked in the Red Sea · Daily Sabah — Houthis reportedly strike Saudi tanker transiting Red Sea

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.

The Ring, Not the Perimeter

The Mines Themselves Are Not the Target; Everything Within Ten Kilometres of Them Is

A new ACLED study of armed-group activity in Sahel mining zones reports that predation has moved off mine perimeters onto the roads, villages and market hubs around them. The only version of the finding available to us is a summary published by a magazine of US Africa Command.

Africa Defense Forum published the summary on 4 August and updated it on 5 August under the house byline “ADF”. Its account of the ACLED report says armed groups increasingly strike within a ten-kilometre radius of mining sites — roads, communities, commercial hubs — rather than the installations themselves, and describes JNIM as the dominant non-state actor in the Sahel’s mining sector, competing with Islamic State Sahel Province for access to and control of mines. Two caveats belong in the same breath as the figure. Africa Defense Forum is published by US Africa Command, a party to the information contest it is describing. And we have not read the ACLED original: the sample size and the date range behind the ten-kilometre finding were not in the retrieved text, and a quotation in the ADF piece about raids on JNIM bases appears without an identifiable speaker.

The incident record the ring is meant to describe is thinner than the geometry suggests. The Africa Report’s Pius Adeleye reported on 28 May that a Chinese-run gold operation at Narena, 45km southwest of Bamako, was attacked on 18 May: equipment burned, workers abducted, production disrupted. MiningFocus Africa, writing on 17 June, dates an earlier attack on Chinese-operated works at Naréna to 12 May 2025. A January 2026 attack on the Morila site in Sikasso region, with equipment burned and hostages briefly held, comes to us through a 2 June analysis piece in ModernGhana rather than a wire, and should be treated as unverified. Separately, Africa Defense Forum reported on 16 June that China’s embassy in Mali had told its nationals to leave artisanal and small-scale gold mining and evacuate; the date of that statement was not captured.

Assessment: If the ten-kilometre finding survives contact with the primary document, it reprices what “securing a mine” means. Perimeter security protects the asset and concedes the corridor, and the corridor is where the money and the labour move. That is the same operating logic Bamako is fighting on the fuel roads — tax the transit, leave the installation standing, make the state pay for movement. What to distrust is the packaging rather than the data: AFRICOM’s magazine has an institutional interest in a Sahel where JNIM’s finances are legible and growing. Read against Mali’s claim last week that mining paid $178 million into a new infrastructure fund, the two accounts describe the same ore and disagree about who is charging for it.

Sources: Africa Defense Forum — ACLED finding on armed groups within 10km of Sahel mines · The Africa Report (Pius Adeleye) — JNIM extortion of Chinese miners, Narena attack · MiningFocus Africa — dating of earlier Naréna attack on Chinese-operated works · ModernGhana — analysis citing the January 2026 Morila attack (unverified) · Africa Defense Forum — Chinese embassy instruction to nationals in Mali

Litres and Percentages

Mali Reports 807 Tankers and a 12 Percent Resupply Rate in the Same Briefing

The Malian trade ministry says 36.95 million litres of fuel reached Bamako in a week and that stocks are sufficient. Both figures are the government’s own, and nothing published reconciles the volume with the rate.

Malijet reported around 30 July that 807 tanker trucks had delivered 36.95 million litres to Bamako in seven days, gave the resupply rate as 12 percent, and quoted Minister of Industry and Trade Moussa Alassane Diallo describing stocks as sufficient. Afrikinfos-Mali corroborated the volume on 31 July — “more than 36.9 million litres” in one week — and placed it at the 29th periodic hydrocarbon-supply monitoring meeting, chaired by Diallo on Thursday 30 July at the Chambre de Commerce et d’Industrie du Mali, where the stated priorities were rebuilding the national security stock, strengthening regional supply, pressing petroleum operators to hold strategic stocks and diversifying import corridors. A lower-tier site, infoactualite-divine.com, reported 850 tankers arriving at dawn on Friday 31 July under heavy FAMa escort; that convoy figure has not been matched by Malijet or AMAP and should be held as unconfirmed. Mali imports roughly 95 percent of its fuel by road, chiefly from Senegal and Côte d’Ivoire; no customs document establishing that share was retrieved. The blockade dates to 3 September 2025, announced by JNIM spokesman Abou Houzeifa al-Bambari.

Who escorts the litres has changed. Jeune Afrique reported on 28 November 2025 that convoys were moving under Malian army and Russian Africa Corps escort with aerial surveillance, and that the Nigerien army had brought in 82 tankers under AES mutual assistance; an unnamed security source told the magazine the improvement coincided with “une certaine inactivité du Jnim contre les citernes” alongside a large army sweep. Since then Africa Corps has pulled back. Benedict Manzin, lead Middle East and Africa analyst at the UK firm Sybiline, told Africa Defense Forum in June: “By and large they are taking more of a backseat role.” ACLED figures cited by the same publication show Russian-linked incidents in Mali down more than 33 percent between 2024 and 2025 and running at 24 a month since the start of 2026. The Congressional Research Service puts Russian personnel in Mali at as many as 2,500 in early 2026, hedged in its own text as reported.

Assessment: The two numbers in the ministry’s briefing do not speak to each other. Thirty-seven million litres sounds like relief; a 12 percent resupply rate sounds like a shortfall; neither is published with the denominator that would decide which it is. That is the recurring shape of this file — the only fuel series anyone can quote is the government’s, which lets a physical blockade be managed as a communications problem. The escort data cuts the other way. If Africa Corps is down to 24 incidents a month and holding Bamako, the convoy risk has been transferred back to FAMa, and the AES has begun conscripting private hauliers to absorb it: Niger stripped 33 operators of their licences in January, a detail we have only through tertiary sourcing and would not print as settled.

Sources: Malijet — 807 tankers, 36.95 million litres, 12% resupply rate (Minister Diallo) · Afrikinfos-Mali — 29th hydrocarbon supply monitoring meeting, 30 July 2026 · Jeune Afrique — Africa Corps and Nigerien army escorts, unnamed security source · Africa Defense Forum — Manzin on Africa Corps taking a backseat role · Africa Defense Forum — ACLED data on Russian-linked incidents in Mali · Congressional Research Service IF12389 — estimate of Russian personnel in Mali

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.

Where Sudan's gold went

Declared value of Sudanese gold exports to the UAE, by year, in US dollars

Chatham House, 'Gold and the war in Sudan', 26 March 2025, using UN Comtrade

One Group, Three Numbers

A Darfur Court Struck by Army Drones Has Two Death Tolls, Two Locations and One Source

Every published account of the 2 August strike on a customary court in RSF-held Darfur traces back to the Emergency Lawyers collective. The UN’s own statement cites the press rather than its own verification.

Sudanese Armed Forces drones struck a traditional court in Darfur on the afternoon of Sunday 2 August. Al Jazeera, reporting the same day, put the toll at “at least 35 people” killed and placed the court in western Darfur. The Council on Foreign Relations' Global Conflict Tracker, in an entry dated 2 August, gave “at least thirty-seven people” killed at “a civil court in an RSF-occupied village” in northern Darfur. A UN readout carried “at least 35 people were killed and dozens more injured” — and attributed that figure to “international media” rather than to any UN verification of its own. The originating source in each case is the same: Emergency Lawyers, the Sudanese lawyers' collective that Al Jazeera describes as having documented abuses by both sides of the war. No SAF comment, no independent confirmation and no imagery verification has been located.

The strike sits inside a week in which both commanders spoke in absolutes. On 3 August Sudan Tribune reported the army’s chief of staff, cited as al-Atta, saying the SAF was “advancing on all fronts” and vowing that no RSF fighters or foreign mercenaries would remain in Sudan by the end of 2026, a claim pegged to gains along the Omdurman–El Obeid road. Four days earlier, on 30 July, the RSF released video of Mohamed Hamdan Dagalo instructing his forces to seize Khartoum. On Monday 3 August, OCHA warned that drone strikes are killing civilians and obstructing aid delivery, a warning issued the day after the court strike and referencing it.

Assessment: The discrepancy is not sloppiness by any single outlet; it is the shape of the evidence base inside RSF-held Darfur. Thirty-five or thirty-seven, western or northern, traditional court or civil court — the variance comes from one collective’s report travelling through three editorial systems without a second witness. Do not average the figures and do not let the UN’s restatement launder them into confirmation: a UN body sourcing its own casualty line to “international media” is telling readers what it cannot see. Note also who is accused here. This is the internationally recognised government’s air arm, struck while its chief of staff was promising a finish by December.

Sources: Al Jazeera — Sudan army drone attack on Darfur kills 35, rights group says · CFR Global Conflict Tracker — thirty-seven killed at a civil court in northern Darfur · UN News mirror — UN cites international media for the 35 figure · UN News — OCHA warns drone strikes killing civilians, obstructing aid · Sudan Tribune — army chief of staff says forces advancing on all fronts · Al Jazeera — RSF video of Dagalo telling forces to return to Khartoum

Ankara Without the Quad

The RSF’s Political Wing Walked Out in Addis, and Four Days Later the UN Envoy Booked Türkiye

Haavisto travels to Türkiye this week for talks with Turkish authorities and Sudanese stakeholders, under a five-body configuration that is not the Quad — after Tasis declined the AU and UN consultations on 1 August.

The UN’s personal envoy, Haavisto, travels to Türkiye this week for talks with Turkish authorities and with Sudanese stakeholders including youth and women representatives, according to a UN statement carried by UN News on 3 August and written through by Sudan Tribune on 4 August from Khartoum. Sudan Tribune frames the effort as a regional initiative involving the UN, the African Union, IGAD, the Arab League and the EU, following preliminary talks. That is a five-body format, and it is not the Quad — the United States, Saudi Arabia, the UAE and Egypt — whose September announcement set out a three-month humanitarian truce converting to a permanent ceasefire. On 3 February, the US presidential adviser on African affairs, Massad Boulos, said the Quad had reached a peace document acceptable to both parties. Six months on there is no ceasefire.

The context that sets the ceiling on the Ankara trip is four days old. On 1 August the RSF-aligned Tasis coalition declined to attend UN- and AU-facilitated peace consultations in Addis Ababa, citing procedural flaws; Sudan Tribune identifies Ahmed Tugud as its spokesman. Ayin reported on 24 February that the latest Quad proposal was a 90-day arrangement applying to all forces including affiliates — sourced to a senior EU diplomat speaking anonymously, and unconfirmed on the record since. Sudan rejoined IGAD in 2026, per an April International Crisis Group briefing, which also notes that Djibouti chairs IGAD and is close to Burhan. The travel is announced, not completed; no party has published a text.

Assessment: Watch the architecture, not the itinerary. When one mediation format stalls, the reflex is to build another with more chairs at the table, and a UN/AU/IGAD/Arab League/EU line-up disperses the leverage the Quad concentrated in four capitals — two of which, Abu Dhabi and Cairo, are the belligerents' actual patrons. An envoy flying to Ankara to meet youth and women representatives is doing something valuable and something that binds no army. The test of whether this is a parallel track or a replacement is whether Tasis, having walked out in Addis, engages anywhere. Boulos’s February prediction is the honest yardstick for all of it.

Sources: UN News — OCHA warning and envoy’s Türkiye travel · Sudan Tribune — write-through of the UN statement, 4 August · Sudan Tribune — Tasis declines Addis Ababa consultations, citing procedural flaws · Sudan Tribune — Boulos says Quad reached a document acceptable to both parties · International Crisis Group — all eyes on the Quad and the truce framework · Ayin — 90-day proposal, sourced to an anonymous senior EU diplomat

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.

Orders, bills and motions

What has actually taken legal effect against Brotherhood chapters since January 2026

Chapters designated by US executive action

Designation bills enacted in the 119th Congress

Dutch MPs backing a non-binding ban motion

US State Department and Treasury/OFAC releases, 13 January–23 July 2026; Congress.gov; EU Reporter. The Sudan designation appears on CNN Arabic's topic page undated

Order Versus Statute

Four Chapters Designated by Order, Three Bills That Never Moved, One Hearing Still Unrecorded

Washington has designated Brotherhood branches in Lebanon, Egypt, Jordan and — on one undated account — Sudan entirely through executive instruments, while the three congressional bills that would make the same designations permanent have gone nowhere.

The architecture in force is executive. Executive Order 14362, “Designation of Certain Muslim Brotherhood Chapters as Foreign Terrorist Organizations and Specially Designated Global Terrorists,” was signed on 24 November 2025. On 13 January 2026 the State Department designated the Lebanese Muslim Brotherhood as a Foreign Terrorist Organization and SDGT and its leader Muhammad Fawzi Taqqosh as an SDGT, in a statement attributed to Secretary of State Marco Rubio calling it “a first step in support of President Trump’s commitment to eliminate the capabilities and operations of Muslim Brotherhood chapters that pose a threat to the United States.” The same day OFAC designated the Egyptian and Jordanian branches as SDGTs. Further Treasury actions followed on 21 January, 12 March, 19 May — the flotilla release warning that such operations “represent a significant compliance risk for financial institutions” — and 23 July. A Sudanese designation appears on CNN Arabic’s topic page with no date attached, which is why the count is four only conditionally.

Congress has produced three vehicles and no law. S.2293, the Muslim Brotherhood Terrorist Designation Act of 2025, sits in the Senate. H.R.3883, the Muslim Brotherhood Is a Terrorist Organization Act of 2025, exists “to require the Secretary of State to designate the Muslim Brotherhood as a foreign terrorist organization” — a requirement the Secretary has already met four times without it. H.R.4397 was introduced by Representative Mario Diaz-Balart on 15 July 2025, referred to the House Foreign Affairs Committee, and its bill-status record was last updated on 7 May 2026. The Judiciary subcommittee on Federal Courts convened its Brotherhood hearing on Wednesday; the title recovered in every retrieval is truncated at “Hidden in Plain Sight: Confronting —,” and the specialist tracker Legis1 reported on 1 August that the committee’s own site had not confirmed a date. No transcript, witness account or wire copy from the sitting had reached this desk by publication.

The primary record on the most recent Treasury action is itself split. The OFAC release designating a senior Egyptian Brotherhood official together with three individuals and three entities carries 23 July 2026, a Thursday. Steptoe’s weekly sanctions update logs it as 24 July. ANI filed on 24 July describing sanctions imposed “on Thursday.” ConservativeHQ dates it “Friday, July 23, 2026,” which is wrong on the weekday. None of the summaries retrieved names the designees. The Foundation for Defense of Democracies, an advocacy institution with a declared position on proscription, reads the action as Washington “taking the fight to the group’s support infrastructure in the United Kingdom” — a geographic characterisation that is not a Treasury finding and cannot be tested without the SDN entries themselves.

Assessment: An executive order ends when an administration does; a statute does not. That is the only material difference between the two tracks, and it explains why designation advocates keep filing bills that duplicate powers already exercised. It also explains the sequencing: Treasury needs no vote, names individuals, and moves monthly, while the legislation has been static for over a year. Readers should treat Wednesday’s hearing as an event with no established output until a transcript exists — pre-hearing reporting on a boycott is not coverage of a hearing. And a designation count that rests on an undated topic page belongs in a footnote, not a graphic.

Sources: State Department — terrorist designations of Muslim Brotherhood chapters · Treasury/OFAC — Egyptian and Jordanian branches designated as SDGTs · Treasury/OFAC — 23 July designation of a senior Egyptian Brotherhood official · Steptoe — weekly sanctions update logging the action as 24 July · GovInfo — H.R.4397 bill status, introduced 15 July 2025 · Legis1 — Senate panel may examine Brotherhood operations, date unconfirmed on committee site

Nothing to Attach To

Six Months of European Ban Votes, and No Published Theory of What a Ban Attaches To

Dutch and French parliamentarians have voted to outlaw the Muslim Brotherhood; in both capitals the objection raised in reply was the same, that no formally structured organisation exists to be outlawed.

On 20 March 2026 a majority of the Dutch House of Representatives adopted a motion calling for a ban on the Muslim Brotherhood and affiliated organisations, backed by 76 MPs in a 150-seat chamber. Parties including the CDA argued that a ban would be legally difficult precisely because the Brotherhood is not a formally structured organisation in the Netherlands. The motion is a call on government, not a prohibition — JNS headlined it “Dutch parliament finally approves ban of Muslim Brotherhood,” which mislabels the instrument. In France, the National Assembly passed a resolution designating the Brotherhood a terrorist organisation and urging the European Union to follow, with La France Insoumise opposing, after a report titled “Unmasking the Muslim Brotherhood: Brotherism, Islamophobia and the EU” by Florence Bergeaud-Blackler and Tommaso Virgili. That account comes from the Middle East Forum, an advocacy publisher.

The French government’s own qualifier — that the measure did not amount to an immediate designation, and that any EU-level decision would require legal assessment and consensus among member states — reaches this desk only through a Wikipedia summary, not a French primary text, and should be sourced before it is quoted. Austria, which folded a ban into its anti-terrorism law in June 2021, remains the only European state described as having enacted one. In Britain, Keir Starmer told Jewish News in December 2025 that the group is under “very close review,” and Home Office minister Lord Flint later said all threats are kept under review. The Henry Jackson Society, which leads the UK proscription campaign, was asked by the New Statesman how a ban would affect the Muslim Association of Britain and answered: “Any organisation that meets the proscription criteria – namely that it is demonstrably ‘concerned in terrorism' – would be affected by a ban.” The Counter Extremism Project notes the group is not outlawed in Britain and that, absent specific intelligence, the UAE’s allegations about named individuals and organisations cannot be corroborated. No UK movement surfaced in the past seven days.

Assessment: Proscription law needs an addressee. Where none is registered, a ban either attaches to nothing or attaches to whichever mosque, charity or association a minister later decides is the Brotherhood — which is the question every campaigning think tank has declined to answer in writing. That vacuum is why the enforcement that actually bites comes from finance ministries rather than parliaments: sanctions name people and companies, and require no theory of the organisation at all. Watch for two tells in coverage of this file. Motions reported as bans, and the legal caveats supplied by advocacy publishers rather than by the governments that issued them.

Sources: EU Reporter — Dutch motion adopted 20 March with 76 votes · JNS — headlines the Dutch motion as an approved ban · Middle East Forum — France’s National Assembly votes to designate the Brotherhood · New Statesman — Inside Britain’s Muslim Brotherhood, with the HJS response on proscription criteria · Jewish News — Starmer’s “very close review” and pressure from peers to proscribe · Counter Extremism Project — the group is not outlawed in Britain

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.

One Masthead, Two Verbs

The Washington Post Wrote “Claims” on Monday and Carried AP’s “Says” Two Days Later

On 3 August the Post’s own staff put Iran’s denial in the headline. On 5 August, the day Tehran announced a route agreement with Oman, the wire copy the Post carried had neither the hedge nor the denial.

The Post’s staff-written piece of 3–4 August ran as “Trump administration claims Hormuz deal is close as Iran denies negotiations,” and it is the only headline in the American set that carries both halves of the dispute. It quotes Treasury Secretary Scott Bessent telling CNBC on 4 August that a deal could come “today or tomorrow” to open the strait to “freedom of movement,” and that “We are in talks with the Iranians.” Trump had told reporters on 2 August, per CNN’s live file, “What we’re doing is we’re talking to them in the form of a negotiation,” adding, “I call it the denuclearization of Iran” — and, after Tehran denied talks had resumed, calling the Iranian leadership “unbelievably duplicitous.” Foreign Minister Abbas Araghchi had posted on Telegram on 2 August that negotiations with Oman were in their “final stages” and that the waterway would never return to its pre-war status.

Two days later the same masthead carried AP copy — bylined Elena Becatoros, Samy Magdy and Darlene Superville, datelined Cairo — headed “Trump says deal to reopen the Strait of Hormuz could come as early as Wednesday.” The hedge is gone and so is Iran’s denial. Bloomberg handled the same day in two stages: “Trump Fuels Hopes of Hormuz Reopening With Hints a Deal is Near” at 10:33 UTC, then “Iran, Oman Reach Agreement on Proposed Strait of Hormuz Shipping Route” once Tehran said something had actually been agreed. CBS reported Iran’s foreign ministry saying the two sides settled on a route Wednesday and were still finalising joint management. CNN carried a Gulf official putting the odds of an Iran–Oman deal by Friday at 50-50. CNBC and the AP file at PBS both led with Iran and Oman. Fortune alone kept the record in the headline: “Trump claims — yet again — that a deal to reopen Hormuz is close.”

Assessment: The divergence inside one masthead is not ideological, it is industrial. Staff reporters can afford a subordinate clause for the denial; wire copy travels with a neutral verb and a subject who is speaking, and the carrying paper inherits both. Bloomberg’s claim-then-event sequence is the defensible version of the same mechanism and deserves credit. What to distrust: the thing announced on 5 August is an Iran–Oman understanding on a route, with joint management explicitly unfinished and no text published by any government. Reuters' account of Tehran’s red lines rests on a single senior Iranian source — one side of a two-sided table.

Sources: Washington Post — Trump administration claims Hormuz deal is close as Iran denies negotiations · AP at Washington Post — Trump says deal to reopen the Strait of Hormuz could come as early as Wednesday · Bloomberg — Trump Fuels Hopes of Hormuz Reopening With Hints a Deal is Near · Bloomberg — Iran, Oman Reach Agreement on Proposed Strait of Hormuz Shipping Route · Fortune — Trump claims, yet again, that a deal to reopen Hormuz is close · CNBC — Iran, Oman say Strait of Hormuz talks in final stages

Three Seas, One Claim

One Houthi Tanker Claim Was Placed in Three Different Bodies of Water Inside a Day

CNN put a missile strike on the Saudi tanker Daisy in the Gulf of Aden, Bloomberg reported a threat to tankers in the northern Red Sea, and an aggregator placed the attack off Yanbu. No operator or CENTCOM statement confirms damage to any vessel.

CNN’s 5 August live file reported that the Houthis said Wednesday they had targeted the Saudi oil tanker Daisy in the Gulf of Aden with a ballistic missile, claiming they struck it and forced it to change course and turn back. Bloomberg, the same day, reported Houthi military spokesman Yahya Saree saying the group would attack Saudi oil tankers in the northern Red Sea. Signal SCV, an aggregation site, carried the story under a contributing writer’s byline as a missile attack on a Saudi tanker off Yanbu, on the Red Sea coast. These may be two separate things — a stated threat covering one sea, a claimed strike in another — or one claim degrading in transmission. They should not be merged, and no outlet in the set does the work of separating them. The verb load-bearing in all three accounts is “claimed.” Better sourced and adjacent: UKMTO said early Thursday that a tanker reported hearing two explosions while transiting the Strait of Hormuz off Oman on Wednesday, and that vessel and crew were safe — Reuters copy, carried in Haaretz’s live file.

One parallel in the file went undrawn by every Western outlet retrieved. The Houthi-run Humanitarian Operations Coordination Center describes its safe-transit service for shipping as voluntary and cost-free, per Signal SCV following a Reuters report two days earlier. At the other chokepoint, the framework Iran and Oman are negotiating charges service fees for security and environmental protection — that description comes from AP copy read at PBS, attributed to two regional officials. Israel Hayom describes the arrangement differently again: not two lanes but a single two-way corridor with Iranian oversight of entering vessels. Iran has required vessels to use a route through its own territorial waters since 19 June, according to CNN. A non-state belligerent is giving maritime protection away while a state negotiates the right to bill for it.

Assessment: Geography is not decoration in a tanker war. A claimed strike in the Gulf of Aden and a threat to the northern Red Sea imply different launch geometries, different insurance zones and different demonstrated reach; conflating them credits the claimant with capability it has not shown. What to distrust: an aggregation site carrying a contributing writer is not a second source, and the absence of any operator or CENTCOM statement is itself reportable information rather than a gap to be papered over. It also sharpens the lead. The reopening being priced at Hormuz assumes one chokepoint. The shipping risk is being generated at three, and only one of them is being negotiated.

Sources: CNN live file — Houthis say they targeted the Saudi tanker Daisy in the Gulf of Aden · Bloomberg — Yemen’s Houthis say they’ll target tankers in northern Red Sea · Signal SCV — Houthis attack Saudi tanker amid Red Sea blockade · Haaretz live file — UKMTO reports tanker heard two explosions off Oman (Reuters) · PBS NewsHour (AP) — Iran and Oman make progress on deal to reopen Strait of Hormuz · Israel Hayom — New Iran-Oman plan for Strait of Hormuz alarms US

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.

Strikes Without a Text

Two Reservists Killed at Majdal Zoun, and Israel’s Stated Cause Went Unevidenced in Every Wire

Israel resumed the heaviest strikes on southern Lebanon in weeks after an explosive device killed two IDF reservists, while US-sponsored talks in Rome continued a second day. No party has published the framework being negotiated.

Two IDF reservists were killed and four seriously wounded by an explosive device in the southern Lebanese village of Majdal Zoun at about noon on Wednesday 5 August; the army cleared the names on Thursday morning. They were Maj. (res.) Harel Birenstock, 34, of Nokdim, a company commander in the 2855th Battalion of the 55th Brigade, and Sgt. Maj. (res.) Tamir Vaknin, 33, of Eilat, a combat soldier in the same battalion. The initial IDF probe, as relayed by the Times of Israel liveblog, says the troops entered a structure “during efforts to demolish Hezbollah infrastructure” when the device detonated; Al Jazeera describes a booby-trapped building. Haaretz notes these are the first Israeli fatalities in Lebanon since late June, when Capt. David Hazutt was killed. The Gush Etzion Regional Council announced Birenstock’s death on Wednesday evening, ahead of army clearance.

The IDF said on X that “in response to a blatant violation of the ceasefire by the Hezbollah terrorist organisation, the IDF has begun conducting precise strikes in southern Lebanon.” Before the strikes, Lt. Col. Ella Waweya, the army’s Arabic-language spokesperson, ordered residents of the coastal town of Mansouri to move at least 1,000 metres away, writing that “anyone present near Hezbollah elements, their facilities, and their combat means exposes their life to danger!” France 24 called it the first Israeli evacuation warning in Lebanon in weeks; the Washington Times, running the AP wire, called it the first in more than a month and stated flatly that “the IDF provided no evidence of Hezbollah’s alleged violation of the ceasefire.” Lebanon’s Health Ministry and the state National News Agency reported one killed and 12 hurt when a strike hit the roof of a prayer hall in the Tibnin cemetery.

The strikes landed while Israeli and Lebanese delegations sat through a second day of US-sponsored talks in Rome, with Beirut seeking a phased Israeli withdrawal from the south, per France 24. The Times of Israel wrote that the talks “were said to hit a bump in the road” — a hedge with no named source attached to it in the item. The only American account is from an unnamed State Department official quoted in the same liveblog: “Discussions focused on a range of political and military issues and were extremely productive. The technical teams made progress on determining key details on implementation of the Trilateral Framework.” No government has published that framework. The Times of Israel separately flagged that an interceptor was accidentally fired toward Israeli forces in southern Lebanon.

Assessment: Note what is fully named and what is not. Israel published two dead men’s ranks, ages, hometowns and battalion within 20 hours, and published nothing about the violation it cited as cause — an asymmetry the AP wire flagged and most Israeli copy did not. The reciprocal count comes from a Lebanese ministry, which is the only counter available and should be labelled as such. Watch the phrase “Trilateral Framework”: as with the Hormuz drafts in yesterday’s lead, a process is being kept alive in public by an anonymous official’s adjective — “extremely productive” — rather than by a text anyone can read.

Sources: Times of Israel — IDF strikes southern Lebanon, alleging ceasefire violation · Washington Times (AP) — IDF provided no evidence of the alleged violation · France 24 — Israel resumes strikes as Rome hosts talks · Al Jazeera — one Lebanese and two Israeli soldiers killed in south Lebanon · UPI — Lebanon airstrikes, casualty figures · Israel National News — Gush Etzion council announces Birenstock’s death

On the Record at Last

Netanyahu Says He Never Agreed to the Gaza Plan, and Three Outlets Translate Him Three Ways

In a Hebrew Facebook video on Tuesday, the prime minister gave the first on-record confirmation by any party that a disarmament draft exists — and that Israel was not in the room when it was written.

Speaking to camera on 4 August, in his first public comment on the disarmament plan Donald Trump announced on Friday 31 July, Benjamin Netanyahu said: “They sent us a draft. We did not agree. It is not our draft. We sent our comments” — the rendering used by World Israel News. The National translated a second passage as “President Trump thinks, or his team thinks, that they can get Hamas to disarm and demilitarise Gaza. We did not agree to it.” Antiwar.com rendered a third line as “I stand firm on our security interests. We will not withdraw from our current lines until Hamas is completely disarmed,” and reported he had directed IDF soldiers “to do whatever is necessary to protect themselves, our territory and our citizens.” The Times of Israel’s Jacob Magid placed the remarks “in seeming opposition to” the US-backed plan for an initial Israeli pullback.

The dispute is sequencing. The Board of Peace framework, negotiated between Hamas, the BoP and Egyptian, Qatari, Turkish and American mediators — without Israeli participation, according to The National — has Hamas beginning to hand over weapons while Israeli forces withdraw to the Yellow Line in parallel. Netanyahu wants disarmament first. On 5 August the IDF chief of staff, Lt. Gen. Eyal Zamir, visited Gaza and said the military had been “systematically striking Hamas”: “We have significantly weakened [Hamas] and changed the security reality.” Those remarks reached the press through the IDF Spokesperson’s Unit, not open access. Haaretz’s liveblog carried a headline on 4 August reading “Israel limits Gaza assassinations, allows strikes if ‘imminent danger' present” — a policy shift, if the body text bears out the headline.

Gaza’s Health Ministry, via Haaretz liveblogs, counted 19 killed in Israeli strikes in the 24 hours to 3 August, two more on 3–4 August, and six including a child on 2 August. Arutz Sheva’s ticker reports that unnamed Hamas sources told the Saudi-owned Asharq Al-Awsat that the ceasefire’s second phase will run 210 days across five stages: an adversary-side claim, anonymous, at three removes from any document. A figure circulating on aggregator sites — that Israeli control has grown from about 53% of the Strip to more than 60% — has no primary source we could locate and is not used here.

Assessment: This is the week’s most useful correction to the record. For five days the existence and contents of the drafts rested on anonymous briefings out of Washington; the man who rejected them has now confirmed on camera both that they exist and that Israel was handed a text rather than consulted on one. Two things to watch. First, the translation spread: three outlets render the same Hebrew video three ways, and none has published the Hebrew alongside. Second, the audience — a Facebook video 82 days before a vote does different work at home than the comments Israel says it sent to the Board of Peace.

Sources: Times of Israel — Netanyahu says Israel didn’t agree to the Board of Peace disarmament plan · The National — Netanyahu rejects US-backed Hamas disarmament deal · World Israel News — Netanyahu rules out Gaza pullback · Antiwar.com — Netanyahu on the draft and instructions to the IDF · Haaretz liveblog — Board of Peace urges de-escalation as strikes kill two in Gaza

Smashed Doors, Two Newsrooms

Two Israeli Newsrooms Have Had Their Doors Smashed and One Assailant Left a Note

A Times of Israel feature published overnight catalogues attacks on Channel 12 and Haaretz as the campaign for the 27 October Knesset election turns to disqualification petitions.

In a feature published at 01:31 on Thursday, the Times of Israel’s Ben Sales reports that an assailant vandalised Channel 12’s news office last week, smashing the door and leaving a note reading “Someone will die.” Channel 12 had been attacked earlier in July, possibly by the same man, and Haaretz’s door was likewise smashed. Condemnations came from the outlets, media advocacy organisations and politicians, Sales writes, “including some who accused Prime Minister Benjamin Netanyahu’s government of inciting attacks against the press.” His own framing line is the one to keep: “The shock, however, shouldn’t be mistaken for surprise.” The piece also quotes a political scientist it identifies as Rahat on the two leading opposition parties, led by Naftali Bennett and Gadi Eisenkot, as “centered on their leaders” and having held no primaries.

The campaign around the attacks is being run on eligibility. On 5 August, National Security Minister Itamar Ben Gvir called The Democrats leader Yair Golan “an Israel-hater” who “spreads racist blood libels against the Haredi sector,” and pledged to petition the Central Elections Committee to disqualify him from running “due to his repulsive racism”; the Golan remarks that prompted this are not reproduced in the liveblog item. Avigdor Liberman told Golan to “shut up,” arguing his rhetoric was aiding Netanyahu’s campaign; Golan told Liberman to “stop echoing” right-wing messaging. On 4 August the Likud party court barred serving MKs and ministers from competing for district slots, the party judge holding that it “harms value of equality.” Likud MK Dan Illouz, who quit the party, told the Times of Israel it “sold out principles to hang onto power.”

Assessment: A disqualification petition costs nothing to file and buys a week of coverage, which is why the Central Elections Committee has become a press strategy rather than a legal one. Note also what the desk cannot verify: no seat poll has been published in the past 48 hours. The numbers still in circulation are old — Steptoe’s late-May survey of polls put the Bennett-led bloc at 58–60 and the coalition at 50–52; JNS reported in mid-July that Channel 14’s polls alone had the coalition crossing 60 and reaching 65. When a campaign’s arithmetic is two months stale, its incitement fights fill the space.

Sources: Times of Israel — Israelis are alarmed over the threat of political violence · Times of Israel — 2026 Israeli elections topic page (Liberman–Golan, Likud court, Illouz) · JNS — Polls, blocs and mergers ahead of Israel’s 2026 election · Steptoe — Israel’s 2026 elections: political landscape and strategic outlook · Haaretz — What to know about Israel’s upcoming election (date: 27 October 2026)

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.

Named states, counted systems

Water and wastewater systems reported targeted, by state, late July–5 August 2026

SecurityWeek, NBC News, ClickOnDetroit and NJ officials via ABC. Michigan's figure is contested: EGLE's own statement says only 'a small number of reports'

Attribution Runs Ahead

Seven States Became Twelve in Six Days, and No Federal Document Has Named Iran

The FBI and EPA warned water utilities about “malicious cyber actors” on 30 July. By 5 August the count had nearly doubled, Bloomberg had promoted the suspects into its headline, and nobody had published a list of who was hit.

The sequence is documented and the gaps in it are documented too. More than 30 Minnesota community water systems were targeted on 26–27 July, per SecurityWeek, with NBC News and the Washington Post placing the operational-technology intrusion at the same scale statewide. On Thursday 30 July the FBI and EPA issued a joint public service announcement to utilities nationwide; per NBC’s reading, the actors “remotely accessed internet-facing devices, changed IP addresses and passwords, and caused utilities to lose monitoring and control capabilities.” The alert named no state and no country. NBC put the figure at seven states on 31 July. Michigan confirmed on 3 August. By 03:24 ET on 5 August, SecurityWeek was reporting at least 12 states, a count it attributed to ABC News. Only Minnesota, Michigan, Georgia, South Dakota and New Jersey have been named publicly. No agency has published a list.

The attribution language degrades as it travels. The FBI/EPA document says “malicious cyber actors.” NBC has a single unnamed law enforcement official saying the Minnesota intrusion “had hallmarks of Iranian meddling.” The Washington Post says “spy agencies suspect” Iran. CBS News, on 1 August, framed it as investigators probing whether Iranian hackers are responsible and noted that official confirmation “can take weeks or months.” Bloomberg’s newsletter of 5 August, at 18:27 UTC, simply asserts it: “Iran-Linked Cyberattacks on US Water Utilities Continue,” reporting the incidents are “expanding and ongoing, according to an information-sharing center” it does not name in the accessible text. That is a headline running a step ahead of the bureau whose alert started the story.

The confirmed consequences so far are narrower than the coverage. In New Jersey, two municipal systems were targeted; per OANN citing ABC News, internet-exposed programmable logic controllers were compromised, operators temporarily lost remote monitoring and automated management, both utilities shifted to manual operation, and service was not disrupted. Georgia’s Clayton County Water Authority said it “experienced a temporary disruption affecting a portion of its operational systems and water service,” with reduced pressure in some areas and service restored within hours. Minnesota’s IT services spokesperson said there was no indication the breaches contaminated any municipal supply. Michigan is where the numbers diverge: WDIV reported nine systems targeted, while the state environment department’s own statement says only that “we received a small number of reports from Michigan communities indicating activity consistent with what federal agencies described.”

Assessment: Two different things could be producing the rise from seven to twelve. Attacks spreading, or reporting catching up after a federal alert told hundreds of utilities what to look for. The second is at least as likely as the first, and it is the reading nobody has printed. Watch for a new CISA advisory number rather than another update to the existing one: a fresh AA-designation would mean the government treats this as a distinct campaign, and would be the first federal document written about these incidents rather than retrofitted to them. Until then, the honest count is five named states and one contested figure in Michigan.

Sources: NBC News — hackers targeted water systems in seven states, FBI says · Washington Post — several states report cyberattacks, spy agencies suspect Iran · CBS News — investigators probing whether Iranian hackers are responsible · SecurityWeek — water sector cyberattacks reportedly hit at least 12 states · ClickOnDetroit (WDIV) — Michigan among states hit · OANN, citing ABC News — two New Jersey systems, manual operations

Old Paper, New Week

The Advisory Being Shared as This Week’s Federal Response Was Written in April

CISA’s AA26-097A carries the strongest government attribution to Iranian-affiliated actors in the file. It was published in April 2026 and last updated 22 July — before the water intrusions it is being used to explain.

AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” was originally published in April 2026 and updated on 22 July. It predates the Minnesota intrusions of 26–27 July and the FBI/EPA alert of 30 July, yet it is circulating this week as the federal answer to them. Its substance is genuinely load-bearing: the July update adds detection guidance for malicious changes in reusable code modules in Rockwell Automation PLC programs and widens the manufacturer scope to Schneider Electric, Siemens and “possible other PLC manufacturers.” Named sectors are Water and Wastewater Systems, Energy, and Government Services and Facilities including local municipalities. The activity is dated to “at least March 2026.”

The most consequential line in the 22 July addition is a single field observation. At one US victim, the FBI observed the actors download a malicious project file to a targeted PLC using configuration software; analysis indicated the file retained ladder logic for downstream function but added logic overriding the instruction sets responsible for maintaining safe operating parameters. That is a safety-interlock override, on the record from a government agency rather than a vendor blog, and it is the only documented basis for treating water-sector intrusions as a risk to life rather than an availability problem. It is also worth stating plainly what has not been shown: nothing in the current wave of incidents has been demonstrated to have used that capability. Every confirmed case this window ends in manual operation, brief pressure loss, or lost visibility.

Assessment: This is the desk’s recurring failure mode, and it is not confined to government documents. SOCRadar’s Iran–Israel dashboard was returned by search as four days old while its own page says the map data was last updated in March 2026. Halcyon’s Iranian-tactics page carries no date at all. Trellix’s “Iranian Cyber Capability 2026” scopes itself to March. Rolling URLs on live-looking pages are being read as live incident data by newsrooms working fast. The test is simple and almost nobody applies it: find the publication date inside the document, not the one the search engine assigns it.

Sources: CISA — advisory AA26-097A, Iranian-affiliated actors exploiting PLCs · CISA — FBI, EPA and partners update warning on Iran-affiliated threat actors · SOCRadar — Iran-Israel cyber conflict dashboard, data last updated March 2026 · Unit 42 — CL-STA-1128 and Rockwell FactoryTalk on VPS infrastructure

Watch Tomorrow — The Files' Forward Radar

Iran File: Whether Iran and Oman publish the joint announcement Baghaei said was being finalised, and whether the text names any party other than the two coastal states.
Sahel Monitor: Whether the next hydrocarbon-supply monitoring meeting in Bamako reports a resupply rate above the 12 percent given for the week to 30 July, and whether ACLED posts the mining report behind the ten-kilometre finding with its date range attached.
Sudan Crisis Monitor: Whether Haavisto’s Türkiye trip produces a readout that names Tasis, four days after the RSF’s political wing declined the AU/UN consultations in Addis Ababa.
The Brotherhood Brief: Whether judiciary.senate.gov posts the full title, witness list and transcript for the 5 August ‘Hidden in Plain Sight' hearing, and whether the record shows the five Democrats stayed away.
Western Media Watch: Whether any US outlet reconciles or corrects the placement of the claimed Saudi tanker strike, which ran as the Gulf of Aden at CNN and the northern Red Sea at Bloomberg within the same day.
Israel Press Review: Whether the IDF publishes any evidence for the Hezbollah ceasefire violation it cited for Wednesday’s strikes, and whether the Rome talks reconvene as the unnamed State Department official said they would.
Digital Front Monitor: Whether CISA issues a new AA-numbered advisory on the water intrusions rather than a further update to AA26-097A, which was written in April.