MEFILES — Daily Intelligence on the Region's Hard Questions

Iran File — Lead

The Doha shuttle is running against a US election clock, not a nuclear one, and Hormuz is the collateral

Qatari mediators spent twelve hours in Tehran on Friday and flew home the same night, with Iran’s answer to a reciprocal-steps package expected Saturday. The package’s purpose is not a settlement but the resumption of direct US–Iran talks before Tuesday’s midterms. Meanwhile the IRGC says tankers are striking mines in the Strait of Hormuz while CENTCOM says the southern lanes are safe and open. Both claims cannot be true, and the price of oil is being set by whichever one shippers believe.

By The Editor · Iran File · October 31, 2026

Four clocks on one file

The quantities governing the Iran decision in the week to 31 October 2026

Hours from an order to major US operations, per US officials

605

Iranian missiles and drones launched since 7 July, per JINSA

440

Kilograms of 60% enriched uranium unverified by the IAEA

$117.15

Brent crude, 9:00 a.m. ET, 30 October

JINSA Iran War Update (30 Oct); US officials via AP and Axios; IAEA briefing to the Security Council, 27 Oct

One day, five Brent prices

Brent crude for 30 October 2026 as published by five outlets, dollars per barrel

Fortune (8:15 a.m. ET), JINSA (9:00 a.m. ET), WorldOilMonitor (close), TradingEconomics, OneValor

The sequence is now reasonably clear and almost entirely anonymous. Qatari mediators handed Tehran a draft on 25 October described to Reuters, by an official briefed on the negotiations, as a seven-day timeline of daily confidence-building steps with third parties as guarantors. On 28 October a senior Iranian official told Reuters that Qatar had presented no proposal, only “unacceptable” ideas, while an official briefed on the diplomacy told CBS News that a new draft had indeed been presented. Those two accounts have never been reconciled. On Friday a Qatari delegation held more than twelve hours of talks in Tehran and returned to Doha, with Iranian negotiators due to follow. The blocking issue, per a US official quoted by Axios, is sequencing: Washington wants nuclear concessions as part of resuming talks; Tehran wants the naval blockade lifted, frozen funds released and oil sales permitted. The only named Iranian voice in any of it is Foreign Minister Abbas Araghchi, who has said on X that Tehran “continues to review ideas” — a formulation designed to commit to nothing.

The waterway is where the gap between claim and confirmation is widest. The IRGC said on Friday that a supertanker carrying more than two million barrels struck a naval mine and caught fire on an “unauthorized route,” the third such vessel that day; CBS’s running file put Iran’s claim at four, and noted it was unclear whether the ship reported by UKMTO was among them. Oman’s Maritime Security Center evacuated 25 crew from a Panama-flagged tanker about 1.6 nautical miles off Musandam. Reuters, citing security sources, reported a vessel hit by limpet mines — ordnance placed by hand, not struck in passage. Against all of this, CENTCOM commander Adm. Brad Cooper repeated on 30 October that Iran’s navy has been destroyed and the southern lanes are safe and open. The industry’s own account sits between them: Jakob Larsen, chief safety and security officer at BIMCO, told CNBC that “ships are attacked really on a daily basis,” while crude keeps flowing.

Underneath the diplomacy, the machinery for the alternative is being assembled on a published timetable. Trump said in early October he would order no resumption of strikes before 3 November; US officials have told Middle East partners to prepare for possible renewed action afterwards, and officials cited by JINSA say sufficient assets are now in theatre to launch major operations within 96 hours of an order. In that same week Defense Secretary Pete Hegseth fired Lt. Gen. Brett Sylvia, the Joint Staff’s director of strategy, plans and policy, over an investigation into leaks on Iran and Ukraine — the second officer removed from that post under Hegseth. The nuclear file has not moved to match. IAEA Director General Rafael Grossi told the Security Council on 27 October that there is no evidence Iran is rebuilding the struck facilities, and that 440 kg of uranium enriched to 60 percent remains unverified. Mohsen Rezaei, who runs Iran’s Supreme National Security Council, said on 21 October that “not a single gram of enriched uranium will be removed from Iran.”

The most quoted line of the week came from a US official speaking to Axios: “Their best shot to get a deal is right now.” The same official added that Trump might be more inclined to order a major operation if Republicans lose badly on Tuesday — the inverse of the standard assumption that an electoral setback counsels restraint. A regional source told the same outlet that Egypt, Turkey, Iraq, Pakistan and Saudi Arabia have all been pressing Tehran to resume talks before the vote. That is one anonymous source in one outlet, and it should be read as the shape of regional preference rather than as a verified diplomatic fact.

Assessment: Three things deserve scepticism. First, the entire Doha track rests on officials “briefed on” talks they are not party to; the only on-the-record Iranian statement commits to reviewing ideas. Second, Hormuz now has two state narrators with symmetrical incentives to exaggerate — the IRGC to establish an area-denial regime and the legal fiction of “unauthorized routes,” CENTCOM to establish that the blockade works. A mine struck is an accident; a limpet mine placed is an attack. Western headlines split on that distinction all day without resolving it. Third, treat any single Brent figure with suspicion: five publishers put 30 October crude between $111.71 and $118.07. What is not in doubt is who is paying. Egypt raised rates 100 basis points on Thursday against an external environment it did not name. Iraq’s premier arrived in Damascus offering pipeline capacity because the southern route failed. The clock everyone is watching is American; the costs being priced are not.

Iran FileMEFILES tracking

Evidence8 cited sources · Axios · CBS News · CNBC · AP and 3 more

The file

Iran File · 102 editions since 19 July 2026 · 331 stories filed · 4 in this edition · rail shows the last 60

Sources: Axios — Qatari mediators shuttle to Tehran chasing a deal before the midterms · CBS News — Live file on Qatari mediators, Iran’s tanker claims and the Hegseth firing · CNBC — Tankers keep transiting Hormuz; BIMCO’s Jakob Larsen on daily attacks · AP via Military.com — Iran says three tankers struck mines and caught fire in Hormuz · Al Jazeera — Oman rescues 25 crew from a burning oil tanker in the Strait of Hormuz · La Voce di New York — IAEA cannot verify the status of Iran’s 440kg uranium stockpile · PBS NewsHour — Hegseth fires the Pentagon’s top military planner as Trump weighs new Iran strikes · Al Jazeera — Rezaei says Iran will keep its enriched uranium

The Cartoon — October 31

“The last square is the election, and nobody will say what is pencilled in for the one after it.”

MEFILES · the cartoon · Qatari mediators flew back to Doha on Friday after twelve hours in Tehran; Iran’s answer was expected Saturday

$117.15

Brent crude at 9:00 a.m. ET on 30 October, the price backdrop to the Doha shuttle

JINSA Iran War Update (advocacy organisation); four other publishers put the same day between $111.71 and $118.07

440 kg

Iranian uranium enriched to 60 percent that the IAEA still cannot verify or account for

Rafael Grossi, briefing the UN Security Council, 27 October 2026

20.00%

Egypt’s overnight deposit rate after a surprise 100bp hike, the first increase since March 2024

Central Bank of Egypt MPC statement, 29 October 2026

Seats for Netanyahu’s bloc in the final Knesset count, down from the 68 he led out of the last parliament

Israeli Central Elections Committee, final results published 29–30 October

9 Nov

Date the UN Panel of Experts mandate on Sudan lapses, the only standing independent reporting on arms flows into Darfur

UN Security Council Resolution 2828 of 11 September 2026, via Security Council Report

Iran File

The regime, the IRGC, the proxies, the strait — read from the Gulf, not from Washington.

Twelve Hours in Tehran

Qatari mediators shuttle between Tehran and Doha chasing a deal before Tuesday’s vote

A Qatari delegation spent more than 12 hours with Iranian officials on Friday and flew home the same night, with talks due to resume in Doha on Saturday. Every element of the package remains anonymously sourced.

The object of the Doha track is narrow. According to Reuters, citing an official briefed on the negotiations, Qatari mediators handed Iran a draft on Sunday 25 October built around a seven-day timeline of daily reciprocal confidence-building steps, with third-party observers acting as “guarantors.” It is not a settlement; it is a mechanism to get Washington and Tehran back into direct talks on the nuclear file. The sequence since has been contradictory. On Wednesday 28 October a senior Iranian official told Reuters that Qatar had presented no proposal at all, only “unacceptable” ideas; the same day an official briefed on the diplomacy told CBS News that a new draft had indeed been presented. Those two accounts have never been reconciled. On Thursday, CBS was told Iran’s answer was expected by the end of the week, most likely Saturday 31 October.

The blocking issue, as described by a US official to Axios, is a straight mismatch of sequencing: Washington wants Iranian nuclear concessions as part of resuming talks, while Tehran wants the US naval blockade lifted, frozen funds released and its oil sales permitted. Qatar is separately pressing Iran to admit UN inspectors to the struck nuclear sites as a confidence-building step, potentially against some sanctions relief. The same US official framed the calendar bluntly — “Their best shot to get a deal is right now” — and added that Trump might be more inclined to order a major military operation if Republicans lose badly on 3 November. A regional source told Axios that Egypt, Turkey, Iraq, Pakistan and Saudi Arabia have all pressed Iran to resume negotiations before the midterms; that claim rests on one anonymous source in one outlet.

What the mediators are trying to work around is on the record. Mohsen Rezaei, secretary of Iran’s Supreme National Security Council, said on 21 October, per Al Jazeera, that “not a single gram of enriched uranium will be removed from Iran.” IAEA Director General Rafael Grossi told the UN Security Council on Tuesday 27 October that the agency has found no evidence Iran is rebuilding the facilities damaged in US and Israeli strikes, but that 440 kg of uranium enriched to 60 percent remains unverified while Iran restricts inspector access. Separately, Vice President JD Vance sent a letter to Rezaei; Trump characterised the outreach as concerning medical aid rather than peace talks, and Tasnim reported on 30 October that Iran had not replied. On 29 October Tasnim restated seven Iranian conditions for ending the war, two of which — a US withdrawal from areas around Iran and compensation for war damage — are not in any draft described so far.

Assessment: Read the sourcing before reading the optimism. The entire Doha track exists in paraphrase: Axios on “diplomatic sources,” CBS on “an official briefed on the diplomacy,” Reuters on “an official briefed on the negotiations.” No Qatari, American or Iranian official has confirmed the draft’s contents on the record, and the only named Iranian voice, Abbas Araghchi, has said only that Tehran continues to review ideas — deliberate non-commitment. The 28 October split between Reuters and CBS on whether a proposal even exists is not a detail; it is a warning about which capital is briefing whom. And note the inversion in the US official’s remark: a bad Republican night on Tuesday is being described as an argument for escalation, not restraint.

Iran FileMEFILES tracking

440 kgIranian uranium enriched to 60% that the IAEA says it cannot verify

Evidence6 cited sources · Axios · CBS News · Egyptian Gazette · Al Jazeera and 1 more

Sources: Axios — Qatari mediators push for an Iran deal before the midterms · CBS News — live file on Qatari mediators and the new proposal · CBS News — live file on diplomacy and the threat to resume attacks · Egyptian Gazette — aggregation of Axios carrying the fuller US-official paraphrase · Al Jazeera — Rezaei: Iran determined to keep its enriched uranium · La Voce di New York — IAEA cannot verify status of Iran’s 440kg stockpile

Claimed, Not Confirmed

Iran says tankers are striking mines in Hormuz while CENTCOM calls the lanes safe and open

The IRGC Navy reported a third tanker hit on Friday; Adm. Brad Cooper said the same day that Iran’s navy is destroyed and the southern shipping lanes are open. No independent party has confirmed either account.

The IRGC Navy said on Friday 30 October that a supertanker carrying more than 2 million barrels of oil struck a naval mine, exploded and caught fire while using an “unauthorized route” in the Strait of Hormuz. The statement, as carried by TASS, read: “Today, a third tanker struck a mine and caught fire while following an unauthorized route.” Two other tankers had been reported hit earlier the same day in the eastern and western approaches. AP moved the story as “Iran says 3 tankers strike mines and catch fire”; CBS News logged an Iranian claim of four vessels and noted it was unclear whether the ship reported by UKMTO on Friday was among them. Fox News’s live file named the Panama-flagged Louise 1 as catching fire on Thursday 29 October without establishing a cause. Every load-bearing element — mines, the vessel’s identity, the two-million-barrel figure — originates with the IRGC or Iranian state media.

Against that, CENTCOM commander Adm. Brad Cooper repeated on 30 October that Iran’s navy has been destroyed and the southern lanes through Hormuz are safe and open. The industry describes something in between. Jakob Larsen, chief safety and security officer at BIMCO, told CNBC that “ships are attacked really on a daily basis,” even as CNBC reported that commercial traffic, mostly oil tankers, has continued to transit and crude keeps flowing. CNN said on 15 October that it had verified video of the Singapore-flagged container ship GFS Pride sinking on 13 October after being struck by unknown projectiles — unknown, not mines. USNI News recorded near-daily strikes on shipping through early October. Araghchi said on 25 October that Hormuz “will not return to pre-war status.”

Prices are the one reading neither side controls, and they are not clean either. For 30 October alone, retrieved sources put Brent anywhere from $111.71 (OneValor) to $118.07 at 8:15 a.m. ET (Fortune), with JINSA logging $117.15 at 9:00 a.m. ET against $115.15 on 26 October — internally consistent, but published by an advocacy organisation. TradingEconomics put WTI at $102.95 on 30 October, up 0.93 percent on the day, 10.85 percent over the month and 68.83 percent year-on-year; CBS News reports both benchmarks roughly 70 percent above a year ago. The clearest measure of who gains: ExxonMobil’s third-quarter profit was reported Friday at $15.4 billion against $7.5 billion a year earlier, attributed to higher crude prices and war-related refining margins — a figure we have taken from CBS via an aggregator and have not yet checked against Exxon’s own release.

Assessment: The word doing the work is “mine.” A mine supports an area-denial campaign and a legal theory about “unauthorized routes” — damage inflicted on ships that disobeyed Tehran’s traffic rules. A projectile is simply an attack, with an attacker. CNN’s verified footage from 13 October described unknown projectiles; the IRGC describes mines. Until a flag state, owner, salvor or UKMTO says otherwise, the mine narrative is a claim about the legal character of the war, not an established fact. Cooper’s claim is the mirror image: a navy cannot be destroyed and simultaneously be hitting shipping near-daily. Both commands are describing the waterway they need their audiences to believe in. The freight and insurance market is describing the one that exists.

Iran FileMEFILES tracking

+68.8%WTI crude, year-on-year, 30 October (TradingEconomics)

Evidence6 cited sources · TASS · AP · CNBC · CNN and 2 more

Sources: TASS — IRGC says third tanker struck a mine on an “unauthorized route” · AP via Military.com — Iran says 3 tankers strike mines and catch fire in Strait of Hormuz · CNBC — tanker attacks, oil flows and the BIMCO assessment · CNN — verified video of the GFS Pride sinking after strikes by unknown projectiles · Fox News — live file naming the Panama-flagged Louise 1 · TradingEconomics — WTI crude series, 30 October

The Planner and the Clock

Hegseth fires the Joint Staff’s top planner in the week before a possible post-midterm campaign

Lt. Gen. Brett Sylvia, director of Strategy, Plans and Policy, was removed over an investigation into leaks on Iran and Ukraine — the second officer stripped of that post under this war secretary.

The Pentagon cited “severe misconduct” in removing Sylvia, reported on 28–29 October, and said he had been under investigation for leaking classified information on Iran and Ukraine. Axios reported on 29 October that Sylvia acknowledged the misconduct on video after failing four polygraph tests, attributing that account to a single unnamed US official; it has not been corroborated elsewhere. AP and PBS note he is the second general removed from the J5 post under War Secretary Pete Hegseth, who, per Al Jazeera, has cut the number of US generals and admirals by 20 percent and stood up an autonomous warfare command. The Washington Post reported the firing on 28 October against the backdrop of Trump weighing new strikes on Iran.

The timing is what places this on the Iran desk. Trump posted on Truth Social in early October, per Al Jazeera, that he would not order a resumption of strikes before the 3 November midterms. AP reported that US officials have told Middle East partners to prepare for possible renewed action after that date, with no final decision taken. US officials cited in JINSA’s 24–26 October update say enough assets are now in theatre to launch major operations within 96 hours of an order; CNBC named the deeply buried Pickaxe Mountain site as a potential target on 26 October. Hegseth’s visit to Israel this week to discuss renewed joint strikes, and the claim that the plans target petrochemical and nuclear facilities, appeared in an Al Jazeera opinion column rather than a news report, and should be read accordingly.

Assessment: Two readings compete and the day does not settle between them. One: an officer at the centre of Iran and Ukraine planning was leaking, and was caught. Two: the J5 chair has become the seat from which this Pentagon’s war planning is contested, and the second occupant to lose it in short order is evidence of friction over what happens after Tuesday. The polygraph detail — four failures, a videotaped admission — comes from one anonymous official to one outlet, and is precisely the kind of detail that makes a dismissal look clean. Watch whether a successor is named before 3 November. A vacancy left open through the window the AP describes would say more than the firing does.

Iran FileMEFILES tracking

96 hoursTime US officials say is needed to launch major operations once ordered (JINSA, 24–26 Oct)

Evidence5 cited sources · Axios · PBS NewsHour/AP · Al Jazeera · Washington Post and 1 more

Sources: Axios — fired general acknowledged misconduct after failed polygraphs, per one US official · PBS NewsHour/AP — Hegseth fires the Pentagon’s top military planner as Trump considers new Iran strikes · Al Jazeera — Pentagon fires general it says leaked classified information · Washington Post — Hegseth general firing and the Iran strike debate · Al Jazeera (opinion column, not a news report) — on the US-Israel war on Iran and reported strike planning

Sahel Monitor

Mali, Burkina, Niger, the AES bloc, JNIM, and the Russian bargain — security as economics.

The Disappeared File

Human Rights Watch presses Bamako on a vanished former minister, six months after his seizure

A dispatch published Friday asks Mali’s military authorities to say where Mountaga Tall and his son are. It lands eight days after the same organisation accused the army and its Russian partners of fresh atrocities in Mopti.

Human Rights Watch published a dispatch dated 30 October 2026, “Critic of Mali’s Junta Forcibly Disappeared Six Months On,” written by its senior Sahel researcher Ilaria Allegrozzi. According to the allAfrica daily roundup of the same date, the organisation called on Mali’s military authorities to disclose the whereabouts of Mountaga Tall, a former government minister and critic of the junta, and of his son Cheick Mamadou Tall. Unidentified gunmen are reported to have seized Mountaga Tall in Bamako on 2 May; his son is said to have disappeared two weeks later. The disappearances themselves are reported rather than independently established in the material available to this desk; what is confirmed is that a major international organisation has now put the case on the record and that six months have passed without an official account of either man’s location.

The dispatch follows two HRW releases from earlier in the month. On 19 October the organisation published “Mali: Military Attacks on Civilians, Insurgent Abuses,” finding that Mali’s military and the allied Russia-controlled Africa Corps — formally the Wagner Group — had killed and wounded scores of civilians in attacks and in custody in violation of international humanitarian law, and calling on the African Union Peace and Security Council to act urgently; the release cites ACLED data and includes video analysis showing the destruction of a health centre after an apparent Malian military drone strike in Talahandak. On 22 October HRW followed with “Unlawful Drone Strike, Torture of Civilians in Mopti Region,” centred on an apparent military drone strike on 16 September in Guélédié. That finding rests on fifteen remote interviews conducted between August and September, including three witnesses in Guélédié and four former detainees at the Sévaré military base.

Assessment: The sample is small and HRW says so — fifteen remote interviews is a floor, not a census, and readers should treat it as the minimum documented rather than the scale of what happened. The more useful signal is the pairing. A junta that is losing ground in the north and centre is simultaneously tightening at home: a former minister unaccounted for since May, and reporting that the Conseil national de transition ratified an ordinance on 22 October extending deprivation of nationality to Malians by birth, a claim that rests on an aggregator index and needs the text before it can be called a law. Watch whether the AU Peace and Security Council answers the 19 October call. Silence there is itself the story.

Sahel MonitorMEFILES tracking

15people HRW interviewed remotely for its Mopti findings

Evidence5 cited sources · Human Rights Watch · allAfrica

The file

Sahel Monitor · 102 editions since 19 July 2026 · 209 stories filed · 2 in this edition · rail shows the last 60

Sources: Human Rights Watch — Mali dispatch index, including “Critic of Mali’s Junta Forcibly Disappeared Six Months On” · allAfrica — roundup carrying the HRW call on Mountaga Tall, 30 October 2026 · Human Rights Watch — “Mali: Army, Russia’s Africa Corps Commit New Abuses”, 22 October 2026 · Human Rights Watch — “Mali: Military Attacks on Civilians, Insurgent Abuses”, 19 October 2026 · allAfrica — coverage of the 22 October HRW findings

Two Openings, One Rival

ECOWAS and the AES sit down in Dakar while Algiers quietly signs with Niamey

The first ministerial dialogue between the two West African blocs took place on 17 October. Four days later, Algeria’s chief of staff signed a military cooperation protocol with Niger’s defence minister.

ECOWAS and the Alliance of Sahel States held an introductory diplomatic and ministerial meeting on Saturday 17 October 2026 in Dakar, according to Nigeria’s Daily Trust, which framed it as laying a foundation for future cooperation “in a spirit of fraternity, mutual respect” — the paper’s characterisation, in an editorial, not a communiqué. Breakthrough News, a left-aligned advocacy outlet, reported on 26 October that the two blocs had opened talks aimed at rebuilding relations after years of tension over military coups, regional sanctions and sovereignty. The procedural detail available to this desk comes from Rio Times, an aggregator whose account could not be corroborated: a first formal negotiating session on 17 October after separate preparatory meetings the day before, an expert round on 18 October, agreement on joint working groups toward a framework cooperation agreement — and no date set for the next ministerial.

Whether the gap is filled is the test of whether Dakar was a process or a photograph, and the stakes are material rather than ceremonial. The Africa Center for Strategic Studies reports that petroleum supplies from Senegal and Côte d’Ivoire account for nearly 95 percent of Mali’s fuel — the corridors that JNIM has spent the past year attacking, with Bellingcat verifying six separate attacks across three Malian regions between mid-September and early November 2025 that destroyed more than 130 fuel tankers. Separately, the Benin-based outlet La Nouvelle Tribune reported on 24 October that Algeria is changing method in the Sahel more than eighteen months after the shot-down drone rupture, with chief of staff Saïd Chanegriha signing a military cooperation protocol with Nigerien defence minister Salifou Modi in Algiers on 21 October. The report has not been confirmed by APS or El Moudjahid.

Assessment: Two openings, both aimed at the same vulnerability. The AES states broke with ECOWAS on sovereignty grounds, then discovered that sovereignty does not move diesel; the blockade economics make the coastal corridors a standing lever Abidjan and Dakar did not have to build. Algeria’s play is the one to watch and the one nobody with weight is covering: if Algiers is arming Niamey while reopening to Bamako, it is offering a regional alternative to the Africa Corps bargain without Moscow’s price. Treat the Chanegriha protocol as unconfirmed until an Algerian state source carries it. And note that Modi, the signatory, is a figure whose standing depends on a Niamey political settlement this desk cannot currently verify.

Sahel MonitorMEFILES tracking

95%share of Mali’s fuel supplied via Senegal and Côte d’Ivoire, per ACSS

Evidence6 cited sources · Daily Trust · Breakthrough News · Rio Times · africacenter.org and 2 more

Sources: Daily Trust — on the ECOWAS–AES rapprochement and the 17 October Dakar meeting · Breakthrough News — ECOWAS and AES open talks to rebuild relations · Rio Times — account of the Dakar negotiating sessions and working groups · Africa Center for Strategic Studies — JNIM attacks in western Mali and the fuel import picture · Bellingcat — tracking the fuel blockade crippling Bamako, 3 December 2025 · La Nouvelle Tribune — Algeria arms Niger and courts Mali, 24 October 2026

Sudan Crisis Monitor

SAF versus RSF, the sieges and the famine, the gold economy, and the diplomacy of press releases.

Both Parties, One City

UN investigators place RSF drones and SAF torture cells in the same El Obeid file

The Fact-Finding Mission’s 28 October paper documents encirclement and expanding drone warfare around El Obeid alongside mass arrest and torture inside it. The symmetry between the two parties is the finding, not the framing.

The Independent International Fact-Finding Mission for the Sudan published *Sudan’s Unrelenting War: Civilian Devastation and Deepening Insecurity in El Obeid* on Wednesday 28 October, as a conference room paper, A/HRC/65/CRP.1, to the Human Rights Council’s 65th session. The Mission says it shared its findings with the Government of Sudan on 26 October, two days before publication. Per OHCHR, El Obeid remains partially encircled by the Rapid Support Forces; the paper documents expanding drone warfare, attacks on vital infrastructure, and what OHCHR calls an “alarming contraction of civic space” imposed by the Sudanese Armed Forces and their allies. Mona Rishmawi, an expert member of the Mission, told the press briefing: “Thousands have been arrested by SAF security cells, detained and tortured in unofficial locations and in El Obeid Central Prison, kept under appalling conditions.” The Chair, Mohamed Chande Othman, said: “The situation in and around El-Obeid remains grave and the risk of atrocities are high.”

The Mission has been building to this for months. On 3 July it warned that “El Obeid must not become the next crime scene,” with the UN human rights chief, Volker Türk, describing eighteen months of “siege-like conditions”; Othman said then that the patterns documented in El Fasher — “encirclement, attacks on civilian infrastructure, restrictions on humanitarian access, and widespread abuses against civilians — serve as a stark warning.” Othman delivered a separate statement to the General Assembly’s Third Committee in New York on the same day the report landed. The Mission notes its own timing: publication fell two days after the first anniversary of the fall of El Fasher. Readers should note that siege lengths in circulation do not agree — the Mission’s eighteen months against Middle East Eye’s account of an RSF final offensive launched on 26 October 2025 after more than 500 days of encirclement.

Assessment: The editorially significant move is the pairing. A Human Rights Council mechanism has now put RSF drones from outside El Obeid and SAF detention and torture inside it between the same two covers, which cuts directly across the dispute inside the Quad over whether the two parties should be described in equivalent terms. Note the document’s status: a conference room paper, shared with Khartoum forty-eight hours before release — enough margin for a response, not enough for a correction. The Mission documents; it does not enforce. The body that can attach consequences to findings about resupply is the 1591 Panel of Experts, whose mandate lapses on 9 November.

Sudan Crisis MonitorMEFILES tracking

500,000civilians in El Obeid, including 105,000 displaced (GIWPS, July 2026)

Evidence6 cited sources · OHCHR · UN News · Radio Tamazuj · UN News (3 July 2026) and 1 more

The file

Sudan Crisis Monitor · 102 editions since 19 July 2026 · 230 stories filed · 3 in this edition · rail shows the last 60

Sources: OHCHR — Expanding drone warfare and severe repression in El Obeid put civilians at risk · OHCHR — Full conference room paper, A/HRC/65/CRP.1 · UN News — Fact-Finding Mission report on El Obeid, 28 October · Radio Tamazuj — Mission warns of drone attacks and repression in El Obeid · UN News (3 July 2026) — “El Obeid must not become the next crime scene” · Georgetown Institute for Women, Peace and Security — civilians at risk in Northern Kordofan

Command and Proximity

Al Jazeera maps commanders to rape sites, and states plainly what the map does not prove

A feature published on 30 October sets out the Centre for Information Resilience research that underpinned Britain’s sanctions round four days earlier — and carries its own limits in the text.

Al Jazeera published on Friday 30 October a feature mapping commanders linked to wartime sexual violence in Sudan, built on an investigation by the Centre for Information Resilience that was funded by the UK Foreign Office and that underpinned the designations announced on Monday 26 October. The caveat is in Al Jazeera’s own copy and should travel with the findings: the research covers the RSF, the SAF and allied forces, and identifies commanders who exercised authority in places where atrocities were reported, but does not establish that each named individual personally committed or ordered acts of rape. Of one named figure, Al Jazeera writes that his presence forms part of CIR’s assessment of command structures but “does not establish that he directed the filmed attack.” The outlet says it approached both the RSF and the SAF for response; we have not been able to establish from the retrieved text whether either replied.

The sanctions the research fed into covered fifteen senior commanders drawn from both parties, with travel bans and asset freezes, alongside £15 million in aid for survivors and conflict-affected civilians, over alleged atrocities in El Fasher and North Darfur and in Wad Madani, Gezira. Sudan Tribune’s account names RSF Lieutenant Colonel Abbas Khater Bakhit, designated over the torture of detainees during the October 2025 El Fasher takeover, alongside RSF commanders Abdelbagi Dahab Talbo and Mustafa Abdullah Ahmed Shenibat; SAF commanders were designated over alleged involvement in massacres at Wad Madani. Foreign Secretary Ed Miliband, quoted by Sudan Tribune, said those who perpetrated crimes against humanity “must be held accountable and support from all external backers to the warring parties must end,” and separately that “the war in Sudan has created a humanitarian catastrophe.”

Assessment: What CIR has produced is pre-prosecutorial infrastructure: open-source command mapping that establishes who held authority where, which is the evidentiary layer any future case for command responsibility has to rest on before it can argue orders. Treat the two as different claims and resist outlets that collapse them. The political content sits in the second half of Miliband’s sentence — a call for external backers to stand down, with none named, from a government that has just sanctioned both sides. One unverified thread bears on exactly that: a Liveuamap entry dated 30 October reports Vladimir Putin meeting a “Sudanese President” in Moscow. There is no Kremlin, TASS or SUNA readout and no wire confirmation. We are not running it as fact.

Sudan Crisis MonitorMEFILES tracking

15commanders sanctioned by the UK, drawn from both parties, 26 October

Evidence5 cited sources · Al Jazeera · Sudan Tribune · Radio Tamazuj · Middle East Eye and 1 more

Sources: Al Jazeera — Investigation maps commanders linked to wartime rape · Sudan Tribune — UK sanctions 15 commanders from both sides · Radio Tamazuj — UK sanctions 15 Sudan commanders over alleged atrocities · Middle East Eye — UK sanctions officials implicated in mass sexual violence in El Fasher · Darfur24 — UK sanctions 15 Sudanese commanders over El Fasher atrocities

Nine Days Out

The Panel of Experts mandate lapses on 9 November and almost nobody is watching

The only standing independent body reporting to the Security Council on arms flows into Darfur comes up for renewal next week, while the negotiating track has been reduced to prisoner swaps and school exams.

Resolution 2828 of 11 September extended the 1591 Sudan sanctions regime — targeted asset freezes, travel bans and the arms embargo — and renewed the Panel of Experts mandate until 9 November, according to Security Council Report’s October forecast. (The same SCR text renders one date as “until 9 October,” which appears to be an error in the source; we have not seen the operative paragraph of 2828 itself.) The Panel is the only standing independent investigative body reporting to the Council on arms flows into Darfur, and its reporting is the documentary spine of most credible work on external resupply. At the Council on 16 October the United States urged members to expand the arms embargo and strengthen sanctions — “We need a humanitarian truce” — warning that civilians are being killed by weapons and mercenaries flowing into Sudan as well as by hunger. Sudan’s ambassador, Al-Harith Idriss al-Harith Mohamed, said his government had submitted proposals on civilian protection, a ceasefire and monitoring.

The diplomacy running alongside it is modest by design. A Geneva meeting of 21 countries ran 21–23 October; Pekka Haavisto, the Secretary-General’s personal envoy, said the first steps would be prisoner exchanges and coordination between the warring parties over Sudan’s secondary school certificate examinations. A senior US official said there is no military solution and warned of spillover into Chad, describing Washington’s work as complementing the Quad — the US, UAE, Saudi Arabia and Egypt. Security Council Report records that Riyadh reportedly raised concerns about its role in that grouping at a French-hosted ministerial in September, objecting to perceived US favouritism towards the UAE and to language treating the SAF and RSF as equivalent. On 7 October, General Abdel Fattah al-Burhan rejected negotiations outright and vowed to take “every inch” of RSF-held territory. The UN put the number needing humanitarian support at almost 34 million on 21 October.

One live claim bears directly on the resupply question and cannot yet be stood up. Sudanese authorities are reported to have alleged 162 drone attacks launched from Ethiopian territory, killing more than 400 civilians and 102 military personnel, with strikes said to have hit schools, hospitals, health centres and fuel stations. We have this only through aggregation — a Rio Times brief of 30 October attributing AllAfrica of the same date, and a Liveuamap headline that sums the two figures into “over 500”. No named Sudanese official, no ministry statement and no Ethiopian response appears in any of it. What is independently established is the existence of the allegation: Security Council Report’s October forecast notes “persistent allegations of Ethiopian territory being used to supply and launch RSF operations,” and ties them to sharpening concern about the war’s regionalisation.

Assessment: Mandate renewals are where sanctions regimes are quietly narrowed. The question on 9 November is not whether the Panel survives — it almost certainly does — but whether its scope and reporting cadence come through intact, because that determines how much documentary evidence of external resupply reaches the Council over the next year. Watch for trims to language on overflight, gold and third-country transshipment. The Ethiopia allegation shows why the Panel matters: a belligerent government’s casualty claim, circulating through aggregators with no named official attached, is not a substitute for an investigative mandate, and should not be reported as one.

Sudan Crisis MonitorMEFILES tracking

Nov 9date the 1591 Panel of Experts mandate expires

Evidence6 cited sources · Security Council Report · UN News · The National · Radio Tamazuj and 2 more

Sources: Security Council Report — Sudan monthly forecast, October 2026 · UN News — Haavisto on Geneva track and humanitarian need, 21 October · The National — US stresses there is no military solution at Geneva talks · Radio Tamazuj — US presses Sudan for humanitarian truce · Al Jazeera — Burhan rejects talks, vows to retake all territory · Rio Times — Africa Intelligence Brief, 30 October 2026 (aggregation of the Ethiopia claim)

Syria File

The transition after Assad — the new government, the armed factions, the returns, and who is paying for it.

Camp at Harim

A French commander dies at Harim, and Damascus’s foreign-fighter bargain shows its seams

Syrian internal security forces killed a member of the French jihadist camp in Idlib on 28 October. The dispute is not over ideology but over who may carry a rifle outside the wire.

The Internal Security Command in Idlib Governorate said a patrol spotted an armed group leaving the “French camp” towards the Harim area “in violation of the agreement not to leave the camp with weapons”, and that “as the patrol moved to pursue and stop the group, its members opened fire on the security force, prompting a response to the sources of fire.” The statement was carried by the state broadcaster al-Ikhbariya and relayed by Rudaw. Enab Baladi’s English service, publishing around 29 October, reported that one armed man was killed and a civilian wounded in the Wednesday 28 October clash. The wording of the official account is the part worth holding onto: the government’s arrangement with the camp is not disarmament but a permission regime, under which weapons are tolerated inside a perimeter and prohibited outside it.

The fighters tell it differently. A French fighter living in the camp told the Syrian Observatory for Human Rights that Syrian security authorities had orchestrated an ambush inside the city and confiscated surveillance cameras and recording devices to destroy evidence — an anonymous combatant’s testimony, relayed by SOHR, relayed by Rudaw, three layers deep and uncorroborated. Cleaner is the group’s own statement, which accused the local administration of acting on “directives dictated by France” to neutralise them and of failing to honour a reciprocal ceasefire reached on 22 October 2025. The news site The New Region reported that French fighters vowed “revenge” late Wednesday and identified the dead man as Abu Ayman al-Faransi of Firqat al-Ghuraba; its page metadata is inconsistent with its October 2026 dateline, so treat the identification as unconfirmed.

Shortly afterwards, Syrian state media reported that two defence ministry personnel had been killed by “unknown assailants” in Idlib. That is sequence, not causation, and no party has tied the two incidents. The run-up was visible: on 7 October the al-Ghuraba group, based in Harim, said the government had sent machinery to demolish ruins around its camp and voiced fears of a raid, and a number of Uzbek fighters announced they were joining the French contingent to defend it. The precedent is October 2025, when fighting between the government and al-Ghuraba ended in the ceasefire the group now says has lapsed. That earlier round followed the kidnapping for ransom of an 11-year-old French-Muslim girl, Maymouna Ferstay, by French fighters, and a separate confrontation in which the Syrian army surrounded the area to seize two French nationals sought by Paris.

Assessment: Ahmed al-Sharaa’s foreign-fighter problem has never been that these men might turn on him; it is that policing them visibly costs him, and not policing them costs him with Paris and Washington. Harim is where that arithmetic is settled one patrol at a time. Distrust the analytical frame now forming around the incident: the Jerusalem Post’s 30 October piece quotes Le Monde second-hand and bracket-edited, which is a reading of a reading. The number to watch is not the single death but whether the 22 October 2025 arrangement is rebuilt or abandoned — and whether Uzbek fighters stay attached to a French quarrel.

Syria FileMEFILES tracking

1armed man killed at Harim, per the Idlib Internal Security Command

Evidence4 cited sources · Enab Baladi · Rudaw · The New Region · Jerusalem Post

The file

Syria File · 102 editions since 19 July 2026 · 142 stories filed · 2 in this edition · rail shows the last 60

Sources: Enab Baladi — one killed as Syrian security forces clash with French fighters in Idlib · Rudaw — Internal Security Command statement via al-Ikhbariya, and SOHR testimony · The New Region — French fighters vow revenge, name Abu Ayman al-Faransi · Jerusalem Post — analysis of the Harim clashes, quoting Le Monde

Baghdad Comes Calling

Iraq’s prime minister reaches Damascus with a pipeline offer and an awkward cabinet behind him

Ali al-Zaidi’s first visit to Syria produced warm language and a revived pipeline concept. What he brought with him from Baghdad is the more interesting part of the file.

Syrian President Ahmed al-Sharaa received Iraqi Prime Minister Ali al-Zaidi in Damascus on 28 October for talks on bilateral relations, trade and energy, al-Zaidi’s first trip to Syria. The Iraqi premier described Iraqis and Syrians as “one people in two countries.” According to the Iraqi Prime Minister’s Office, the two governments are seeking to revive an Iraq-to-Syria pipeline with a potential capacity of 2 million barrels per day. That figure is a stated design potential, not throughput and not a contracted volume, and no financing, route or timetable has been published. The visit and its particulars were written up in English in our sweep by a single outlet, Seth J. Frantzman for the Foundation for Defense of Democracies' Long War Journal, on 30 October; FDD is a Washington institution with a declared position on the new government in Damascus, and the framing should be read accordingly even where the facts are not in dispute.

The sequencing carries its own signal. Al-Zaidi had travelled to Jordan on 26 October, a visit that coincided with a controversy over the closure of a border crossing with Iran. Kurdistan24, citing unnamed sources, reported that the Syria leg had originally been scheduled before Amman and was pushed back “due to the events that occurred in Jordan, which were given priority” — a single-sourced claim about an itinerary, and nothing more. The border itself is being worked from the military side: the Iraqi News Agency reported on 24 October that Defence Minister Naif Mukayif al-Shammari had toured the Iraq–Syria frontier strip in the Nineveh sector. And on 15 October, two figures affiliated with Asaib Ahl al-Haq, a US-designated Foreign Terrorist Organization, entered the Iraqi cabinet: Deputy Prime Minister Laith al-Khazali, a senior AAH leader, and Labour and Social Affairs Minister Mohammed al-Mousawi of the militia’s political party, Sadiqoun.

Assessment: Normalisation between Baghdad and Damascus is being built by the two governments least able to guarantee what they sign. A 2-million-barrel figure attributed to a prime minister’s press office is an aspiration dressed as infrastructure; the pipeline has been revived rhetorically before. The harder question the visit raises is domestic to Iraq — a cabinet that now includes AAH-linked ministers is opening an energy and security corridor to a president those currents spent a decade fighting. Watch whether Damascus’s border-security demands survive contact with that coalition, and source al-Zaidi’s “one people” line to the Arabic original before it hardens into a quotation of record.

Syria FileMEFILES tracking

2m bpdstated potential capacity of the proposed Iraq–Syria pipeline, per the Iraqi PM’s Office

Evidence3 cited sources · FDD’s Long War Journal · FDD (mirror)

Sources: FDD’s Long War Journal — Syria hosts Iraqi PM amid security challenges in north and south · FDD’s Long War Journal — Iraq juggles border security and ties with Iran, Syria and Jordan · FDD (mirror) — Syria hosts Iraqi PM for visit

Egypt File

The economy that cannot close its gap, the border it will not open, and the river it cannot control.

Cairo's first hike since March 2024

Central Bank of Egypt overnight deposit rate, before and after the 29 October MPC meeting

Central Bank of Egypt MPC statement, 29 October 2026, via Reuters and Ahram Online

Tight Money, On Schedule

Egypt’s central bank hikes 100 basis points as the IMF sets a December deadline

The Monetary Policy Committee raised rates for the first time since March 2024, against a consensus for a hold, on the same day the Fund said its Cairo mission is focused on keeping monetary policy tight.

The Central Bank of Egypt’s Monetary Policy Committee raised policy rates by 100 basis points on Thursday 29 October, taking the overnight deposit rate to 20.00%, the overnight lending rate to 21.00% and the main operation and discount rates to 20.50%. It is the first increase since March 2024, and Reuters, AFP and the Egyptian domestic press all described it as a surprise against analyst expectations of a hold. The published MPC statement, carried by the Saudi Press Agency and Youm7, said the committee resolved to raise base return rates “by 100 basis points.” Al Arabiya rendered the framing as a response to “an unfavourable external environment and escalating uncertainty”; the bank’s English text, as reproduced by TradingEconomics, said the move “aims to keep inflation expectations anchored and safeguard the disinflation trajectory, amidst challenging external conditions and heightened uncertainty.”

The decision sits oddly against the headline price data. Annual urban inflation slowed to 13.9% in September from 14.5% in August, and non-food inflation eased to 18.0% from 19.5%, per the CBE’s 11 October report. But monthly urban CPI rose 1.3% in September against 0.1% in August — CAPMAS attributed most of the jump to a 15.1% rise in vegetable prices. Separately, Reuters reported on 29 October that an IMF staff mission had spent the week in Cairo seeking a staff-level agreement on the final review of the $8bn Extended Fund Facility, with the Fund targeting Executive Board clearance by mid-December and the talks centred on “maintaining tight monetary policy” and a fiscal consolidation plan. Neither institution linked the two events.

Assessment: The sequencing is suggestive and unproven: the Fund says it wants tight money, the central bank tightens the same day, and neither says the other’s name. Treat the connection as inference. Treat the currency explanation the same way — Masrawy and Zawia3 tie the hike to the pound’s record low, but the pound appears nowhere in the CBE’s quoted language. Note also how badly this was aggregated. TradingEconomics ran it under a headline reading “Egypt Cuts Rates by 100Bps” and wrote that the MPC “slashed” the deposit rate; Amwal Al Ghad called it a shift “to support growth amid easing inflation pressures.” Two outlets reversed the direction of Egyptian monetary policy within hours of an unambiguous statement. Readers pricing Egypt off aggregator feeds are pricing noise.

Egypt FileMEFILES tracking

20.00%CBE overnight deposit rate after the 29 October hike

Evidence6 cited sources · Ahram Online · Reuters · SPA · TradingView/TradingEconomics and 1 more

The file

Egypt File · 102 editions since 19 July 2026 · 141 stories filed · 2 in this edition · rail shows the last 60

Sources: Ahram Online — Egypt’s central bank raises key interest rates · Reuters via MarketScreener — first hike since March 2024 · SPA — CBE MPC statement, Arabic text · TradingView/TradingEconomics — surprise rate hike wire · Reuters via Investing.com — IMF aims to clear final review by mid-December · Zawya — annual urban inflation slows to 13.9% in September

Courting the Carriers

Suez Canal Authority meets Hapag-Lloyd twice in ten days as Bab al-Mandab risk persists

Chairman Ossama Rabiee’s diplomacy with shipping lines is running faster than the traffic recovery it is meant to secure.

The Suez Canal Authority’s own site reported on 30 October that it held a video conference with Hapag-Lloyd on “ways to enhance cooperation” — the second meeting between Rabiee’s authority and the German carrier inside ten days, after an in-person session on 21 October. Around the same date, an SCA statement said Rabiee met Greece’s ambassador to Cairo, Nikolaos Papageorgiou, on trade and logistics investment. Neither is traffic news; the cadence is the signal. The underlying numbers remain well below pre-disruption levels. Rabiee has put FY2025/26 canal revenue at $4.67bn, up 23% year on year, with August 2026 bringing in $567m from 1,358 transits, a 27% annual rise. Prime Minister Mostafa Madbouly said on 4 October that Egypt is still losing “over $6bn a year.”

Carriers are hedging in public. CMA CGM’s executive vice president for assets and operations, Christine Cabau, said on 14 October that the company is continuing its return to Suez as a permanent and sustainable route; Hapag-Lloyd confirmed in September, per Al-Monitor, that another Asia–Mediterranean container service would transit Suez and Bab al-Mandab in October and December. Against that, ACLED reported about four weeks ago that Houthi territorial gains around Bab al-Mandab and renewed attacks on Saudi Arabia have raised the risk to Red Sea shipping and energy infrastructure. One further caution on the quarterly figures: Rio Times and Financial Afrik attribute the $1.26bn Q2 revenue print partly to tanker traffic rerouted by a closure of the Strait of Hormuz, a framing Rio Times sources to Africa Intelligence and which this desk could not independently confirm.

Assessment: Canal receipts are the hard-currency line that reserve headlines obscure. Net international reserves hit $57.35bn at end-September, a record in level terms, but the month added only $133.7m — a chart of monthly deltas reads nothing like a chart of the level, and Egypt Independent credits remittances, not trade, for the banking sector’s $31.2bn in net foreign assets. That is why Rabiee is on video calls with carriers rather than announcing volumes. A recovery narrative written off two Hapag-Lloyd meetings and a CMA CGM quote would be premature: the carriers' return is conditional, incremental and reversible, and the body tracking the threat says the threat is growing.

Egypt FileMEFILES tracking

$4.67bnSuez Canal revenue, FY2025/26, against a stated loss of over $6bn a year

Evidence6 cited sources · Suez Canal Authority · Ahram Online · Daily News Egypt · ACLED and 1 more

Sources: Suez Canal Authority — official site, Hapag-Lloyd video conference · Ahram Online — Suez Canal revenue rises to $4.67bn in FY, chairman · Ahram Online — August traffic and revenue · Daily News Egypt — CMA CGM continues return to Suez · ACLED — Houthi gains around Bab al-Mandab raise risks · SIS — foreign reserves rise to $57.35bn in September

Iraq File

Government formation, the militias on the payroll, the oil that funds both, and the American question.

After the Tripwire

Iraq’s cabinet is finally complete, the Americans are gone, and the bills come due

CENTCOM closed out Operation Inherent Resolve on 30 September; parliament filled the last cabinet seats on 15 October. Baghdad now owns both the security file and the fiscal one, with no coalition presence to blame or to lean on.

US Central Command announced on Wednesday 30 September that the withdrawal of all American forces from Iraq was complete, ending a twelve-year mission. The last troops and equipment left Erbil Air Base, closing a drawdown that ran from 18 August 2025. Iraq marked the date with a four-day holiday it designated Sovereignty Day. “The primary responsibility for addressing Iraq’s remaining security challenges, including ISIS remnants and Iran-aligned militias that undermine Iraqi sovereignty and regional stability, now rests with the Government of Iraq,” the chief Pentagon spokesman, Sean Parnell, said in a statement the same day. President Trump called the withdrawal “orderly” in a social media post and described the broader American involvement as “a very expensive excursion into Hell,” per the Associated Press. The Associated Press also reported that Iran-backed groups celebrated the departure while some Iraqis, particularly in the Kurdish region, were uneasy about it.

Two weeks later, on Thursday 15 October, the Council of Representatives filled the vacant posts in Prime Minister Ali al-Zaidi’s cabinet: eleven portfolios and three deputy prime ministers, one of whom Al Jazeera reported is under US sanctions. Nayef al-Shammari took defence and Yasir al-Maliki interior. That closes a hole that had been open since 14 May, when al-Zaidi was sworn in with a partial cabinet because parliament could not agree on precisely those two ministries — the ones that determine who commands force in Iraq. “The Council of Representatives votes to grant confidence to the government of Prime Minister Ali Faleh Al-Zaidi and its ministerial programme,” the prime minister’s office said on 14 May. Five months of arithmetic later, the government is whole. Which individual deputy prime minister is sanctioned, and under which programme, has not been established on this desk.

The economics are harder than the arithmetic. Al-Zaidi told Al Jazeera the government inherited 208 trillion Iraqi dinars in public debt in May — a figure presented by an incumbent about his predecessor, not an audited number — against an economy that draws roughly 90 percent of government revenue from oil and that shipped about 3.5 million barrels a day through the Strait of Hormuz before the war. The export map has since been rearranged. Bloomberg reported on 3 March, citing people with direct knowledge, that Iraq halted Kurdish exports to Ceyhan with roughly 200,000 bpd shut in and only 50,000 bpd produced for local use. Reuters, citing two unnamed oil officials and relayed by Turkish Minute, reported that Baghdad asked the Kurdistan Region to pump at least 100,000 bpd of state-run Kirkuk crude to Ceyhan through the Kurdistan Pipeline Company. The date of that request is in dispute: the Turkish Minute URL carries a March slug, the page displays 21 October.

Assessment: Treat the 208-trillion figure as a political instrument: it is al-Zaidi’s account of what Mohammed Shia al-Sudani left him, deployed while he fends off criticism of his own record, and the dollar conversion circulating alongside it depends on an exchange-rate repricing nobody has pinned down. The more consequential unknown is the sanctioned deputy prime minister. With no troops in country, Washington’s remaining lever over Baghdad is the financial system; whether Treasury acts or stays conspicuously quiet will show whether the post-withdrawal relationship is transactional or adversarial. The second thing to watch is silence of a different kind — the PMF Service and Organisation Law, whose sponsors, having finally released interior and defence, now have something to trade.

Iraq FileMEFILES tracking

208tndinars of public debt, by al-Zaidi’s own account

Evidence6 cited sources · Al Jazeera · AP · BBC · Bloomberg and 1 more

The file

Iraq File · 102 editions since 19 July 2026 · 135 stories filed · 2 in this edition · rail shows the last 60

Sources: Al Jazeera — Iraq’s parliament approves al-Zaidi’s cabinet amid economic concerns · Al Jazeera — Iraq’s parliament approves the al-Zaidi government, 14 May 2026 · AP via PBS NewsHour — US military says Iraq withdrawal is complete · BBC — Last UK and US troops leave Iraq as anti-Islamic State mission ends · Bloomberg — Iraq halts crude shipments via key pipeline to Turkish port · Turkish Minute — Iraq asks Kurdistan Region to help send crude to Turkey (relaying Reuters)

Announcement and Silence

Tehran says Baghdad agreed to expel Iranian Kurdish groups. Baghdad has not said so

Iran’s ambassador claimed on 20 October that Iraq had committed to removing PJAK and PDKI figures from the Kurdistan Region. The Iraqi national security adviser’s account of the same meeting contained no such undertaking.

Mohammad Kazem Al-Sadegh, Iran’s ambassador to Iraq, said on 20 October that Baghdad had agreed at a joint security meeting to expel or hand over Iranian Kurdish opposition figures based in the Kurdistan Region, naming the Kurdistan Free Life Party (PJAK) and the Democratic Party of Iranian Kurdistan (PDKI). The Iraqi national security adviser’s own statement on that meeting contained no such commitment. Two cautions belong in the same sentence as the claim. First, this is an Iranian official’s assertion about what the Iraqi side conceded, and the Iraqi side has neither confirmed nor denied it. Second, it reached this desk through the AND Magazine Morning Brief of 30 October, a Substack newsletter written from a US national-security perspective — a partisan secondary source, not a wire. The underlying Iraqi documents have not been read here.

The party that would have to execute any such agreement — the Kurdistan Regional Government, which actually hosts these groups — was not a party to the announcement at all. The surrounding pressure is real enough: Iranian state media said on 25 October that the IRGC had struck an Iranian Kurdish opposition group’s base in Iraqi Kurdistan with drones, a claim logged by the Council on Foreign Relations' conflict tracker citing AFP and, like the ambassador’s statement, asserted by Tehran rather than confirmed by Baghdad or Erbil. Separately, the CFR tracker records the PKK withdrawing from camps in northern Iraq on 12 October. The US Embassy in Baghdad left its Level 4 “Do Not Travel” rating unchanged in an advisory updated 23 October, but revised the summary to reflect “an increase in potential armed attacks by the Iranian-supported Houthis and Iranian efforts to target U.S. government officials in the region.”

Assessment: The asymmetry is the story, and it is a pattern rather than an incident: Tehran announces an Iraqi commitment, Baghdad declines to confirm or deny, and Erbil — which would bear the cost — is not consulted. Eleven days of federal silence is itself an answer of a sort, though an ambiguous one; it leaves the claim standing in Iranian media without obliging anyone in Baghdad to act. Watch the national security adviser’s office and the KRG interior ministry, not the foreign ministry. Note too what has changed since the lead story: with no American presence left in country, an Iraqi government that quietly absorbs such announcements faces less friction for doing so, and fewer counterweights if it does not.

Iraq FileMEFILES tracking

11 dayssince Tehran’s claim, with no Iraqi confirmation

Evidence3 cited sources · andmagazine.substack.com · Council on Foreign Relations · US Embassy Baghdad

Sources: AND Magazine Morning Brief, 30 October 2026 — Iranian ambassador’s expulsion claim · Council on Foreign Relations — Global Conflict Tracker, political instability in Iraq · US Embassy Baghdad — Iraq travel advisory, updated October 2026

The Brotherhood Brief

The organization as structure — designations, networks, finances, legal battles. Structure over slogans.

A Category Doing Work

Four days from Michigan’s vote, the Brotherhood is the Republican case against Abdul El-Sayed

Trump, Ted Cruz and Mike Rogers have made alleged Muslim Brotherhood ties the central charge against the Democratic Senate candidate. All of it is confirmed as said; none of it is established as true.

Speaking on Thursday 29 October, President Trump said of the Michigan Democrat: “If you’re Black, or if you’re Jewish, and if you vote for Abdul, you’re crazy,” according to a CNN analysis published 30 October. The same piece quotes Republican candidate Mike Rogers asking in the candidates' final debate: “Are you for America, or are you for these terrorist groups overseas?” On Wednesday 28 October, Senator Ted Cruz told his podcast “Verdict With Ted Cruz,” with co-host Ben Ferguson, that El-Sayed’s family and political connections to the Brotherhood could endanger US intelligence operations and military personnel, citing the 1991 Brotherhood memorandum’s phrase about “eliminating and destroying the Western civilization from within.” The write-up of Cruz’s remarks notes explicitly that the January 2026 chapter designations did not constitute criminal convictions.

El-Sayed has denied the charge on the record repeatedly: “I have never been a member of the Muslim Brotherhood,” he told Fox News in October; to Newsmax on 20 October he said, “I clearly disavowed it… If it’s not clear enough, I clearly disavow it. Are we good?”; to Bret Baier on 23 October he dismissed a 2012 letter as “a ridiculous 2012 statement in a letter, you’re going to pull that out of context.” The supporting material is thinner than the accusations. The Investigative Project on Terrorism, an advocacy organisation with a declared position, published a six-part series by Steven Emerson on 28 October whose central assertion is an absence — that it found no statement by El-Sayed criticising Brotherhood ideology. A Townhall item of 29 October recycles a RedState claim about a fundraising entity called “Intuitive Solutions,” sourced through a Peter Schweizer post and unsupported by any primary document. A Gateway Pundit report, citing The Midwesterner, claims Mohamed Soltan — sentenced in absentia by a Cairo court in 2015 in a Brotherhood-funding case — is donating to the campaign. No FEC filing has been examined.

A media-tracking analysis by Nima Akram, published 28 October at Newscord, a media-criticism outlet working from its own stored corpus rather than a census, counted 289 stored Fox News and New York Post headlines about El-Sayed, of which 36 tied him to terror, Islamism or the Brotherhood, and none characterised the allegations as baseless. Its wider corpus of 119 stored articles naming the Brotherhood runs from 10 November 2025 to 28 October 2026, and it dates the surge to mid-October. The same analysis records that PolitiFact rated Trump’s claim that El-Sayed is a jihadist Brotherhood member “Pants on Fire” on 27 October — a rating The Files has not independently verified.

Assessment: The designation architecture built between EO 14362 in November 2025 and the Sudanese listing in March 2026 was argued for as a foreign-policy instrument. Its first large-scale domestic use is an election. Note what the category permits: an administrative listing, which requires no conviction, is being spoken as though it were one, and the burden has quietly inverted into proving a negative. Distrust the aggregation chain in particular — Schweizer to RedState to Townhall, The Midwesterner to Gateway Pundit — where no primary document is ever produced and the donation claim is checkable against pre-general FEC filings nobody has checked. Tuesday’s margin will set the designation lobby’s tempo in the next Congress, including whether H.R.3883 gets floor time.

The Brotherhood BriefMEFILES tracking

36of 289 stored Fox News and New York Post headlines about El-Sayed tied him to terror, Islamism or the Brotherhood (Newscord)

Evidence6 cited sources · CNN · Yahoo News · investigativeproject.org · Townhall and 2 more

The file

The Brotherhood Brief · 102 editions since 19 July 2026 · 208 stories filed · 2 in this edition · rail shows the last 60

Sources: CNN — analysis of Trump’s Michigan attacks on El-Sayed · Yahoo News — Cruz says El-Sayed poses a risk, notes designations are not convictions · Investigative Project on Terrorism — Emerson, ‘El-Sayed In The Brotherhood’s Orbit' (advocacy) · Townhall — recycled RedState claim about ‘Intuitive Solutions' · Gateway Pundit — unverified claim of a Soltan donation · Newscord — Akram, headline corpus analysis, 28 October

A Docket Nobody Published

Seven Brotherhood convictions are reported in Jordan, with no court statement to confirm them

A Washington think tank says a Jordanian court jailed seven Brotherhood figures on 25 October. No wire, no Petra report and no named court has carried it — which is itself worth reading.

The claim appears in a policy brief dated 27 October by Ahmad Sharawi, Senior Research Analyst at the Foundation for Defense of Democracies: that on 25 October a Jordanian court sentenced seven Brotherhood leaders and members to terms of six months to three years in a case involving illegal fundraising and money laundering, with five receiving three years, among them Aref Hamdan, reportedly elected to the Shura Council of the rebranded party. The same brief reports that former Brotherhood Shura chairman Hamza Mansour, former deputy leader Jamil Abu Baker and executive council member Mustafa Saqer were also elected to that body. The Files has found no judicial statement or agency match. The court is not named, nor the statute, nor six of the seven defendants, nor whether the sentences are first-instance and appealable. FDD argues for designation; Sharawi’s brief recommends that “Washington should continue investigating the relationships between the Jordanian Muslim Brotherhood and its affiliated organizations to determine whether operational or financial ties persist.”

The confirmed event of the week was an attack on a church at Hamoud on Friday 23 October, which Jordanian authorities called terrorist and whose death toll they raised to nine, The National reported on 24 October. The Royal Palace said security officials briefed King Abdullah II on the investigation without giving details. No attribution to the Brotherhood or to the Umma Party has been established. The Umma Party — the rebranded Islamic Action Front — called the attack “a dangerous crime and a terrorist action that targets our nation and its cohesion.” The National also records that Step News Agency, which it describes as an anti-Brotherhood YouTube channel, recirculated an old clip of Hamza Mansour declining to condemn ISIS outright: a reputational campaign running alongside the courts, not evidence about the attack.

Assessment: Jordan banned the Brotherhood in April 2025 over accusations of complicity in a weapons-manufacturing scheme and then left the Islamic Action Front, the largest bloc in parliament, untouched while it rebranded. That gap is the story, and a convicted Shura Council member would be the lever for closing it. Two readings of the silence are available: Amman prosecuting without publicity to avoid making martyrs before any move on the party, or a claim thinner than its framing. Neither is established, and an advocacy institution being the sole record of a court action is a fact about the record, not about the court. Watch Petra, and watch whether the convictions are first-instance.

The Brotherhood BriefMEFILES tracking

0measures taken against the Islamic Action Front since Jordan banned the Brotherhood in April 2025, per The National

Evidence3 cited sources · FDD · The National · US State Department

Sources: FDD — Sharawi, ‘Jordan’s crackdown on the Muslim Brotherhood is far from over' (single-sourced, advocacy) · The National — Jordan church attack, death toll and Umma Party statement · US State Department — January 2026 designations of Brotherhood chapters, including Jordan

Western Media Watch

How NYT, WaPo, FT, BBC and the wires frame the region — what is emphasized, what is omitted, and what the gap reveals.

Two Kinds of Mine

A naval mine is struck, a limpet mine is placed: Hormuz headlines split on who acted

Between 29 and 30 October at least three tankers burned in or near the Strait of Hormuz. Western headlines divided cleanly between describing an accident and describing an attack — and almost none named the party that put the ordnance in the water.

What was independently established was narrow. Oman’s Maritime Security Center said in a statement on Friday that it evacuated 25 crew roughly 1.6 nautical miles off Musandam Governorate, describing the Panama-flagged vessel as having been targeted; MarineTraffic identified the ship, named in Reuters-sourced copy as the RITI, as a crude oil tanker. Everything beyond that came from the IRGC. In one statement it said two tankers “attempting to pass through the unauthorised route, encountered incidents and were brought to a halt in the waters south of the strait.” In a second it said a supertanker carrying more than two million barrels “exploded and caught fire today as a result of attempting to pass through an unauthorised route.” Al Jazeera, whose headline led on the Omani rescue rather than the tanker count, stated plainly that it was unclear whether the evacuated vessel was one of the three.

The IRGC’s grammar does the work: the ship is the author of its own destruction, and Iran’s ordnance is scenery. That construction travelled intact. The Associated Press ran “Three tankers strike mines and catch fire in Strait of Hormuz, Iran claims” and later “Iran says 4 tankers strike mines”; CNBC ran “Iran claims four tankers struck mines in Hormuz”; Euronews, the Washington Times, CBS News and agency copy carried by the Manila Times used the same shape. Reuters did not. Its headline — “Tanker in Strait of Hormuz hit by limpet mines, security sources say” — describes a different category of event. A naval mine is static and is struck by a moving vessel. A limpet mine is attached by hand to a hull. It is placed by a person. Same ships, same day, two incompatible theories of agency, and neither names who placed it.

Two production artefacts are visible to any reader who clicks. Euronews' URL slug reads `irans-revolutionary-guard-reports-two-tankers-on-fire`; the live headline reads three. Slugs freeze at publication, so the count was revised upward after filing. The AP omnibus carried by WKBN runs under the slug `ap-saudi-arabia-says-drone-intercepted-near-islams-holiest-city-and-other-mideast-news` while the headline reads “Iran says 4 tankers strike mines and catch fire in Strait of Hormuz” — the Saudi drone interception led the file and was displaced during the day. Separately, the largest shipping-security event of the week ran inside an “and other Mideast news” roundup rather than as a standalone. Reuters' limpet-mine line was captured from the agency’s own X account rather than from reuters.com; the desk could not verify the on-site version.

Assessment: The reflex to read “Iran says” as scepticism is backwards here. Hedging the attribution to Tehran launders Tehran’s causal frame: the hedge disclaims the count while adopting the verb. “Strike mines” concedes that the tanker did the striking. Reuters' limpet formulation is the more honest construction precisely because it is unfalsifiable from the surface — it says a hand was involved and declines to say whose, which is the actual state of knowledge. Watch two things next week: whether anyone obtains hull photographs, which would settle mine type in an afternoon, and whether the Deccan Chronicle’s 27 Indian sailors and Oman’s 25 are ever reconciled. They may be different ships. Do not merge them until someone shows the manifest.

Western Media WatchMEFILES tracking

7headlines in the sample that routed the tanker fires through Iran’s own account

Evidence6 cited sources · Al Jazeera · Reuters wire · Reuters official X account · AP and 2 more

The file

Western Media Watch · 102 editions since 19 July 2026 · 201 stories filed · 2 in this edition · rail shows the last 60

Sources: Al Jazeera — Oman rescues 25 from burning oil tanker in Strait of Hormuz · Reuters wire via Daily Sun — Oman rescues 25 from burning ship, Iran halts tankers · Reuters official X account — Tanker in Strait of Hormuz hit by limpet mines, security sources say (on-site version unverified) · AP via CTV News — Three tankers strike mines and catch fire in Strait of Hormuz, Iran claims · CNBC — Iran claims four tankers struck mines in Hormuz as strike fears grow · Euronews — Revolutionary Guard reports three tankers on fire (slug reads ‘two')

Investigated to Confessed

One general, one firing, and a headline spectrum running from inquiry to confession

Pete Hegseth’s dismissal of Lt. Gen. Brett Sylvia on 29 October produced four mutually incompatible evidentiary claims across Western outlets. The trade publication was the most careful; the general-audience outlets were not.

NBC News reported the firing as “Top general fired by Hegseth amid leak investigation” — an inquiry, no accusation asserted. Military.com went furthest in both directions at once: “Hegseth Fires Pentagon’s Top Military Planner Army Lt. Gen. Brett Sylvia Over ‘Classified Leaks' on Overseas War Plans,” naming the officer, placing the charge in scare quotes, and disclosing in its own URL that the characterisation came from a single official. Fox News asserted the accusation as a fact of record: “Hegseth fires top Pentagon strategist accused of leaking classified Iran, Ukraine war information.” The Daily Caller hedged with “allegedly.” CBS News' video desk settled on “apparent media leaks.” The Western Journal added a Justice Department referral the desk could not confirm anywhere else in its results, under a slug containing the phrase “mainstream media.”

One outlet went past all of them. The Jerusalem Post ran “US general fired after confessing to leaking classified information about Iran.” No other headline in the sample asserts a confession; Gulf News' slug renders the same underlying claim as “reportedly admitted.” On the evidence available to this desk, the confession stands alone and is unconfirmed. The pattern across the set is the inverse of what you would expect: the specialist trade outlet, writing for readers who know the man, named him and showed its sourcing in the same breath. The general-audience outlets, writing for readers who do not, granted him less identity — “top general,” “top Pentagon strategist” — and more guilt.

Assessment: Anonymity plus certainty is the dangerous combination, and it is the one the mass-market headlines chose. An unnamed officer cannot be libelled in the reader’s memory, which is exactly why asserting the charge against him costs an editor nothing and why Military.com, whose readers will recognise the name, could not take the same liberty. Treat the Jerusalem Post’s confession line as a claim about a claim until a second outlet carries it; the Gulf News slug suggests both are working from the same upstream briefing, softened in one rendering and hardened in the other. Note also what the leaks were said to concern — Iran war plans — which is the same week’s Hormuz file, viewed from the Pentagon end.

Western Media WatchMEFILES tracking

1outlet in the sample asserting a confession — the Jerusalem Post, uncorroborated

Evidence6 cited sources · NBC News · Military.com · Fox News · Jerusalem Post and 2 more

Sources: NBC News — Top general fired by Hegseth amid leak investigation · Military.com — Hegseth fires Lt. Gen. Brett Sylvia over ‘classified leaks' · Fox News — Hegseth fires top Pentagon strategist accused of leaking Iran, Ukraine information · Jerusalem Post — US general fired after confessing to leaking classified information about Iran · Western Journal — Hegseth fires top general accused of leaking, case referred to DOJ · Daily Caller — Hegseth fires top general for allegedly leaking classified information

Israel Press Review

Reading Haaretz, Times of Israel, Ynet and the Hebrew press — what Israeli media and officials are actually saying.

A 120-seat Knesset, three blocs

Share of seats in the final count of the 27 October 2026 election

Israeli Central Elections Committee final results, via Times of Israel and Israel National News

The Count Closed

Final Israeli tally leaves Netanyahu at 53 seats, and the word “stolen” arrives without a named speaker

The Central Elections Committee finished the double-envelope count on Thursday. The arithmetic is settled; the mandate is not, and President Herzog does not start consulting until Wednesday.

Israelis voted on 27 October for the 120 seats of the 26th Knesset, and the Central Elections Committee completed the count of double-envelope ballots on Thursday 29 October. The Times of Israel reports the final distribution as Netanyahu’s bloc 53, Yair Eisenkot’s bloc 48 and Arab-led parties 19, with Likud on 27 seats, Yashar on 21, B’Yachad 12, the Joint List 11, The Democrats 8 and Ra’am 8. Likud remains the largest single party and is nowhere near a majority. CNN frames the scale of the contraction: 53 seats against the 68-seat coalition Netanyahu led in the outgoing Knesset, where Wikipedia’s election page records Likud’s own outgoing strength at 32. France 24, citing Haaretz on the committee’s announcement, confirmed the same outcome — largest party, short of a majority.

The turnout figures do not agree with each other and should not be mixed. The Times of Israel gives 77.9 percent and 5,716,665 votes cast; Arutz Sheva counts 5,564,764 valid votes; the Jerusalem Post reports 77.7 percent at poll close, up 7.1 points on 2022, which is the cleanest single statistic in the file. Haaretz reported on election day that Netanyahu “repeatedly warned his supporters on Tuesday of what he claimed was” high Arab turnout, under the headline “'Emergency': Netanyahu Rails Nonstop Against Alleged High Arab Election Turnout.” The turnout he warned of materialised: Haaretz’s 28 October live blog ran under “Over 70% of Votes Counted: Arab Parties at Historic High,” and the Arab-led bloc finished on 19. CNBC, on 30 October, headlined that Netanyahu’s party claims the election was “stolen” — a characterisation of the party, with no named official, forum or specific allegation retrievable.

Assessment: Treat the “stolen” line as unfinished reporting, not as an event. Until a named Likud figure says it in Hebrew with a specific allegation attached, it is a wire characterisation — and the place to watch is whether it fastens onto the double-envelope ballots, because those are precisely what was counted on Thursday and the only part of the process with a plausible procedural hook. The arithmetic, meanwhile, is less decisive than it looks. CNBC notes Herzog may give Netanyahu the first call; Ynet puts consultations on 4 November. The number nobody has counted is how many of the 19 Arab-bloc seats recommend Eisenkot, and whether Ra’am’s Mansour Abbas recommends anyone at all.

Israel Press ReviewMEFILES tracking

53Knesset seats for Netanyahu’s bloc, against 68 in the outgoing coalition

Evidence6 cited sources · Times of Israel · Arutz Sheva · Jerusalem Post · CNN and 2 more

The file

Israel Press Review · 102 editions since 19 July 2026 · 240 stories filed · 2 in this edition · rail shows the last 60

Sources: Times of Israel — final results: Netanyahu bloc 53, Eisenkot 48, Arab parties 19 · Arutz Sheva — double-envelope count completed, 5,564,764 valid votes · Jerusalem Post — live updates, turnout 77.7% at poll close, up 7.1 points on 2022 · CNN — bloc at 53, down from a 68-seat outgoing coalition · Haaretz — Netanyahu rails against alleged high Arab turnout on election day · CNBC — weeks of coalition haggling as Netanyahu’s party claims election ‘stolen'

Day 245

One Iranian munition in a day, oil at $117, and a war the Israeli campaign largely declined to discuss

The Iran war is in its eighth month as coalition talks begin. The daily firing rate has collapsed; the price of crude and the American electoral calendar have not.

The war that began on 28 February has run to day 245 without resolving. JINSA, a Washington think tank with a declared pro-Israel orientation, puts Iranian missiles and drones launched since 7 July at “at least 605,” of which one fell in the 29–30 October reporting day, and lists Brent crude at $117.15 a barrel. That gap — a four-month cumulative total against a near-zero daily rate — is the shape of the current phase: an exhausted firing campaign inside an unresolved confrontation. The IRGC’s claim the previous day to have captured a US vessel, and its 30 October statement concerning two oil tankers in the eastern and western Gulf, are Iranian claims and remain unconfirmed; no CENTCOM or Fifth Fleet response has been retrieved.

The diplomatic track is moving slowly and in public. The American Conservative’s day-245 file reports Qatari mediators returned to Tehran on Friday and that Iran has yet to respond to Vice President Vance’s letter proposing talks. Running underneath is NPR’s 22 October report that the United States and Israel are planning for a possible attack on Iran, framed as post-midterms — a story resting on a single anonymous source, which is how it should be read every time it is cited. The calendars now collide: the US midterms fall on 3 November, Herzog’s consultations with party delegations begin on 4 November. Fitch, in the Times of Israel’s 13 October liveblog, kept Israel’s ‘A' rating on negative outlook, noting the 27 October election remained highly competitive.

Assessment: The war is the variable the Israeli campaign coverage priced least. Haaretz’s editorial board on 25 October accused Netanyahu of statements that “could bring Israel’s economy to the brink of collapse” to satisfy far-right allies; Fitch’s negative outlook and a cooling housing market point the same direction. None of that is war reporting, and all of it is war-conditioned. Read from the Gulf, the number that matters is not the seat count but $117 Brent and the Qatari shuttle: a government formed in late November inherits a Hormuz problem it did not campaign on. Distrust any framing that converts the NPR planning report into an intention. Planning documents are not decisions.

Israel Press ReviewMEFILES tracking

605Iranian missiles and drones since 7 July, per JINSA — one of them on 29–30 October

Evidence6 cited sources · JINSA · The American Conservative · NPR · Times of Israel and 2 more

Sources: JINSA — Iran War Update, 30 October 2026 (munitions total, Brent price, IRGC claims) · The American Conservative — Iran War Day 245: Qatari mediators in Tehran · NPR — US and Israel planning for a possible attack on Iran, single source · Times of Israel — 13 October liveblog, Fitch keeps ‘A' on negative outlook · Haaretz editorial — Netanyahu Will Sacrifice Israelis' Jobs to Save His Own · Ynet — Herzog to begin consultations Wednesday 4 November

Digital Front Monitor

Cyber operations, information warfare and the infrastructure of control across the region.

Recycled Threat

An AI video of severed Gulf cables arrives eight days after the threat it illustrates

A clip circulated by Iranian-linked accounts on 27–28 October depicts Gulf cable strikes collapsing banking and communications networks. The underlying Iranian threat was reported on 23 October and has been recirculating with fresh datelines ever since.

CircleID, a specialist internet-infrastructure outlet, reported on 28 October that an AI-generated video circulated by Iranian-linked accounts on 27–28 October depicts attacks on Gulf undersea internet cables followed by widespread failures in banking and communications networks across Gulf states. The report does not identify who produced the video or tie it to any Iranian state body, and no second outlet corroborated its existence within this window; treat it as single-sourced. What the video illustrates is older. Reuters reported on 23 October that two senior Iranian security officials said Tehran had detailed plans to attack undersea communications cables in the Gulf if the United States and Israel resumed strikes. One, speaking anonymously, said that “if Iran is attacked, there will be no more red lines … from undersea cables to military bases, including covert ones,” and warned Washington not to “play with fire.” On 21 October, IRGC deputy head of political affairs Yadollah Javani had named seven major cables beneath the Strait of Hormuz as targets.

The second anonymous official gave the argument its Gulf-facing edge, telling Reuters that Washington’s Gulf allies have invested heavily in such infrastructure and “should hold Washington, not Tehran, responsible for any damage to undersea cables.” The physical picture complicates the threat. Windward, a maritime-AI firm that sells subsea-threat intelligence and therefore has a commercial interest in the subject, counted five cable landings in Kuwait, five in Bahrain and seven in Qatar; six on the UAE’s Gulf coast against 14 at Fujairah and Kalba on the Gulf of Oman; and two at Khasab, 11 on Oman’s Gulf of Oman coast and five at Salalah and Qalhat. Windward also noted the constraint: cutting the shared trunks “would sever Iran’s own links alongside the Gulf states',” while 2Africa and Tata TGN-Gulf do not land in Iran, and neither do the two cables due in 2027. Ynet made the point that matters for sequencing: Israel’s Mediterranean links avoid Hormuz, so the operative threat is less the cut than the blocking of repairs, which could stretch outages for months. Reuters recorded no immediate comment from Gulf states.

Assessment: The threat is eight days old; the video is new. That gap is the story. A synthetic clip costs nothing, requires no access to a cable ship, and produces exactly the image the original statement could only describe — which is how deterrence messaging now works when the underlying capability is constrained by the fact that Iran shares the same trunks. The liability argument aimed at Doha, Abu Dhabi and Riyadh is the real payload: it asks Gulf capitals to price American basing decisions in cable repair time. Watch repair-vessel access and insurance terms, not threat rhetoric. And distrust anything republished this week with a 28–30 October dateline that quotes anonymous Iranian officials — it is the Reuters story wearing a new hat.

Digital Front MonitorMEFILES tracking

7cables beneath the Strait of Hormuz named as targets by the IRGC’s Yadollah Javani on 21 October

Evidence5 cited sources · CircleID · Times of Israel · Ynetnews · Windward and 1 more

The file

Digital Front Monitor · 102 editions since 19 July 2026 · 209 stories filed · 3 in this edition · rail shows the last 60

Sources: CircleID — Iran escalates threats against Gulf undersea internet cables · Times of Israel — Iranian officials say Tehran has detailed plans to hit Gulf undersea cables · Ynetnews — Why the Hormuz cable threat does not sever Israel’s internet · Windward — Iran threatens the Hormuz internet cables (vendor research) · Jerusalem Post — Iran cable threat coverage

Claimed Versus Demonstrated

ESET says Iran’s own internet restrictions degraded Iran’s hackers, and the hackers are back

A semi-annual vendor report and a new persona study, published a day apart, describe an Iran-aligned ecosystem rebuilding capability and brand simultaneously — with one vendor saying out loud that the brand is bigger than the access.

ESET published its APT Activity Report for April–September 2026 on 28 October. Middle East-aligned activity increased over the previous period, the firm wrote, “driven mainly by the return of several established Iran-aligned groups” whose earlier decline was “most likely because internet restrictions imposed by the Iranian regime hindered their own ability to operate effectively” — a named vendor attributing a drop in Iranian offensive capability to Iranian domestic censorship. An OilRig subgroup ESET calls FilthyFeline, along with MuddyWater, resumed operations mostly against entities in Israel, with a smaller number of US companies affected; FilthyFeline also appears to have taken over access to a cellular data service provider in Uzbekistan previously compromised by BladedFeline, another OilRig subgroup. ESET separately documented Arid Viper, a Hamas-affiliated actor, operating against what it assesses to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or an affiliated body — intra-Palestinian espionage, not Israel-directed work. On artificial intelligence, ESET’s statement said researchers “identified several cases of APT groups using AI and large language models – LLMs — at various stages of their operations”; the illustrative case is Russia-aligned UAC-0099 planting a decoy nuclear weapon request in a script comment to trip LLM-based security guardrails, which is manipulation of defensive AI rather than AI-written malware.

A day later, DomainTools Investigations published research on a persona cluster — MrHex, @Mr8ex, MrDarkRoot and Darku3er — running leak sites and Telegram channels. The domain mrhex.sbs was registered on 31 July 2026, carries the second title “Organizational Discloser,” and “attempts to emulate a Wikileaks style of hack and leak reporting.” DomainTools assesses the operation as “an evolving hybrid between a criminal data market system, a hack-and-leak operation, and an emerging OT-access actor in service to Iran, affiliated with Handala and by proxy, Iran’s MOIS” — the firm’s own assessment, not a government attribution. It then draws the line this desk cares about: MrHex “should be considered a credible data-theft, leak-distribution, and unauthorized-access threat whose demonstrated access is narrower than its propaganda claims,” with credible evidence of at least one industrial-control-system compromise. One. Steven Stover of the 780th Military Intelligence Brigade, summarising the work on LinkedIn, noted that Persian-language reporting has described MrHex as an Iranian actor targeting entities in Israel and the US, Kurdish opposition entities, and organisations deemed enemies of Iran.

Assessment: Two findings sit uneasily together and both are worth holding. ESET’s censorship claim cuts against the assumption that a throttled internet is a purely defensive posture: it taxes the state’s own operators. DomainTools' sentence about demonstrated access being narrower than propaganda claims is the standard every reader should apply to the week’s cable video as well — leak brands are optimised for publication volume, not for intrusion depth, and an ICS claim is a marketing asset before it is a capability. The MOIS link runs through one vendor and the phrase “by proxy.” The Arid Viper finding will be the least covered and is the most politically consequential: Hamas-affiliated collection against the Palestinian Authority’s foreign ministry is a Ramallah story, not a Tel Aviv one.

Digital Front MonitorMEFILES tracking

1industrial-control-system compromise for which DomainTools says MrHex has credible evidence

Evidence4 cited sources · WeLiveSecurity (ESET) · GlobeNewswire · DomainTools Investigations · ESET

Sources: WeLiveSecurity (ESET) — APT Activity Report Q2 2026–Q3 2026 · GlobeNewswire — ESET research release on Iran-aligned targeting and Belarus-aligned APTs · DomainTools Investigations — MrHex, a new hack-and-leak campaign attributing itself to Handala · ESET — APT Activity Report Q2–Q3 2026 (PDF)

Numbers In Motion

One Check Point report, three different attack counts, and no confirmed breach of an Israeli election system

Four days after the 27 October Knesset vote, the most-cited cyber figures come from a pre-election vendor report that three outlets read three different ways — and that none of them says election systems were compromised.

Check Point published its Israeli election research on 25 October, two days before the vote. Calcalist reported on 25 October that attacks on government entities rose 82% and those on energy and infrastructure 107%, with organisations in Israel facing an average of 2,700 cyberattacks per week in early October, a 55% increase on the same period in 2025. The Times of Israel, a day later, attributed the 2,700 figure to government bodies specifically, at an 82% increase, with energy and infrastructure attempts up 107% to 3,900 weekly. JNS, picking the report up around 28 October, reported approximately 2,300 attacks per government organisation per week, also an 82% increase. One report, three readings, now circulating as settled fact. The firmer numbers are smaller: Check Point confirmed around 87 cyberattacks against Israeli targets since early October, mainly denial-of-service and defacement, and counted more than 1,200 new election-related websites registered over two months, roughly one in 47 suspected malicious, including a campaign impersonating a “Voter Information Service” by SMS and email.

Check Point singled out Handala, which it said had sharply increased its publication frequency with explicit reference to the election; its own 27 October deck records a “13-night countdown to the elections,” a claimed breach of an unnamed Israeli payment-systems supplier relayed as Handala’s, and a TikTok account using the Central Elections Committee’s name, logo and Hebrew display name. Dark-web monitoring identified the Prime Minister’s Office, the Knesset, the Israel Police, the Foreign Ministry and the Bank of Israel as planned election-day denial-of-service targets. A database purportedly holding 6.5 million Israeli voters' details was “once again” offered for sale. Sivan Dror, Check Point’s director of research and exposure management, said the days around an election are “a critical period during which malicious actors attempt to exploit heightened public attention to amplify their impact,” and urged the public to rely “exclusively on official election channels.” JNS supplied the caveat the figures require: they “concern cyber activity against Israeli targets generally, not confirmed compromises of election systems.”

Assessment: The discrepancy is the finding. A single vendor deck mutated across three news cycles into three incompatible claims about who was attacked and how often, and the version that travels furthest is usually the largest. Against that, the verified count — 87 incidents, mostly denial-of-service and defacement — describes nuisance and spectacle, not interference. Handala’s countdown is a publication schedule, not an intrusion campaign; its payment-supplier breach remains a claim with the victim unnamed. Two party-level allegations logged on the eve of the vote remain headline-only and unreported-out. Post-vote summaries now circulating on anonymous aggregator newsletters, including claims about a military unit doxxing and a foreign-funding referral, are unsourced to any first party. None of it belongs in an interference narrative yet.

Digital Front MonitorMEFILES tracking

87cyberattacks on Israeli targets Check Point says it verified since early October, mostly DDoS and defacement

Evidence5 cited sources · Calcalist · Times of Israel · JNS · i24NEWS and 1 more

Sources: Calcalist — Cyberattacks on Israeli organisations ahead of the election · Times of Israel — Cyberattacks surge in run-up to Knesset election, Israeli firm finds · JNS — How Israel is using technology to guard its election · i24NEWS — Israel cyberattacks soar ahead of elections · Check Point / Cyberint — Israeli Elections 2026 research report (PDF)

Watch Tomorrow — The Files' Forward Radar

Iran File: Whether Iranian negotiators actually arrive in Doha on Saturday, and whether any named Qatari, American or Iranian official — rather than an official “briefed on” the talks — confirms the contents of the draft.
Sahel Monitor: Whether Mali’s transitional authorities respond to Human Rights Watch’s 30 October demand to disclose the whereabouts of former minister Mountaga Tall and his son, and whether Algeria’s APS or El Moudjahid confirms the 21 October Chanegriha–Modi military protocol.
Sudan Crisis Monitor: Whether any Security Council member circulates a draft renewing the 1591 Panel of Experts mandate before it lapses on 9 November, and whether the Kremlin publishes a readout of the reported Moscow meeting with Sudan’s president.
Syria File: Whether Damascus names the French fighter killed at Harim on 28 October in an official account, and whether the Iraqi Prime Minister’s Office publishes any signed document behind the 2-million-barrel-per-day pipeline figure.
Egypt File: Sunday’s first post-decision official pound reference rate when banks reopen, and whether the IMF announces a staff-level agreement on the final $8bn EFF review ahead of its mid-December board target.
Iraq File: Whether Iraq’s national security adviser or the KRG interior ministry confirms or denies Iranian ambassador Mohammad Kazem Al-Sadegh’s 20 October claim that Baghdad agreed to expel PJAK and PDKI.
The Brotherhood Brief: Whether Petra or a Jordanian court statement confirms the seven Brotherhood convictions reported by FDD on 27 October, including the names, the statute and whether the sentences are appealable.

Iran File

Sahel Monitor

Sudan Crisis Monitor

Syria File

Egypt File

Iraq File

The Brotherhood Brief

Western Media Watch

Israel Press Review

Digital Front Monitor

Watch Tomorrow — The Files' Forward Radar

Get every morning's edition — free