Robert Jay Josett was placed on administrative leave from the Costa Mesa Police Department in December 2023. His department had figured out he was using police databases to track his mistress, her boyfriends, and his own wife. The investigation was underway, and the case was building.

Six months later, he logged into Flock Safety and pulled the new boyfriend’s address in Torrance.

He was a suspended officer, under investigation, with no active cases and no legitimate reason to touch the system. He accessed it anyway, and the system let him right in.

That detail…a cop who had already been caught, already been suspended, accessing a nationwide surveillance network without anyone stopping him is the thing you should not be able to stop thinking about.

Because the entire sales pitch for Flock Safety, a company now valued at $7.5 billion, is built on the claim that its systems have controls. That the access is secure. That only authorized users with legitimate purposes can query a network of over 64,000 cameras spread across the country.

Josett was not authorized. He had no legitimate purpose. He got in anyway.

What Flock Actually Is

Flock Safety sells cities what it calls a public safety platform. The core product is a network of AI-powered cameras that read license plates and transmit that data to a centralized cloud database hosted on Amazon Web Services.

Every camera captures every vehicle that passes it. The data is queryable by any law enforcement agency that subscribes.

That last part is important. The database does not belong to your city. It does not sit on a government server that your city controls. It lives on Flock’s private cloud.

That means public records laws, FOIA requests, and municipal oversight mechanisms do not reach it. Residents in any city using Flock have no direct public records access to what was searched, when, by whom, or why.

The network enables cross-jurisdictional queries. A cop in one state can search vehicle movements across the entire Flock network, covering hundreds of jurisdictions, from a desk.

If enough cameras cover your neighborhood, your commute, and your daily stops, a motivated analyst can build an accurate picture of your life without ever leaving the office.

Where you live. Where you work. What time you drop your kids off. What businesses you visit. All of it attached to your plate, which is attached to your name.

Josett used this to track a woman and the men in her life.

Between June and December 2023, he made 13 inquiries into the CLETS database on people unrelated to any active case.

He used Flock to locate specific vehicles.

He contacted his mistress more than 100 times in a single day over a nine-month stretch, via text, phone calls, and social media.

When the department put him on leave, the Flock system should have cut his access.

It did not. Or if it did, it failed to hold.

He pleaded guilty in April 2026 to three misdemeanors: unauthorized computer access and fraud, repeated harassing phone calls, and contempt of court for violating a restraining order.

He received three years of probation and was ordered to complete a 52-week domestic violence program. No felony charges.

This Is Not One Bad Officer

The Institute for Justice has documented at least 16 cases, nationwide, of officers using ALPR systems to stalk romantic partners, ex-partners, or rivals.

These are only the cases that made the news. The list includes:

• A Riverside County, California deputy who tracked a friend’s vehicle through the department’s Flock system.

• A Milwaukee officer who queried a woman and her ex-partner nearly 180 times over two months.

• An Orange City, Florida cop who searched an ex-girlfriend’s family more than 100 times over seven months.

• A Monroe County, Florida sheriff’s deputy who pulled over a woman he met on a TV set by running her plate and then tracking her movements.

Nearly all of them were eventually charged and fired. But the critical question is not how many got caught…it’s how many didn’t.

Every law enforcement officer in every agency with a Flock contract has the ability to run queries on any plate in the network.

Most departments have weak or nonexistent audit log review. Some have no audit function at all.

The system relies on the honor system, enforced occasionally after the fact when misconduct becomes visible enough to investigate. That is not access control, it is the appearance of access control.

The full breakdown - including the Palantir data pipeline that routes your movements to federal agencies, the confirmed cases of ICE and Border Patrol querying local Flock data, the cities that have already canceled contracts after discovering unauthorized federal access, and the practical steps to find out if you’ve been searched - is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

Your phone has three microphones, two or more cameras with sensors tuned to multiple light spectrums, Bluetooth, WiFi, a magnetometer, and a processor fast enough to run real-time audio analysis. You’ve been using it to check Instagram.

That’s going to change after this post.

This isn’t about hacking or doing anything illegal. It’s about knowing the full capability of the hardware you’re already carrying so you can use it in situations that matter…hotel rooms that might not be private, conversations you need to document, unfamiliar spaces you’re entering and don’t fully trust. Prepared civilians extend their senses. This is how you do it with what you already own.

Six capabilities. Most people know zero of them.

The first one is built directly into iOS…no app required, no settings buried in a menu most people never open. It turns your iPhone into a remote listening device with one tap from the Control Center. And it leaves nothing visible on the screen when it’s running.

The full breakdown, all six techniques including the IR camera detection trick, the through-door audio method, and how to scan a hotel room’s network for unauthorized cameras, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

The thing that gives you away isn’t your gear…it’s your face.

When someone who knows what they’re looking for is scanning a room, they’re often not looking for tactical vests or gun bulges.

They’re looking for people who are watching the same things they are.

The systematic eye movement. The slight muscle tension around the jaw. The deliberate positioning near exits.

The way someone sits with their back to a wall and then immediately checks every person who walks through the door.

Prepared civilians do all of this. They think it’s making them safer.

In a specific, measurable way, it’s also making them visible…to the exact category of threat they’re most worried about.

In intelligence and protective work, there’s a concept called “going gray.”

We’ve all heard of it. We’ve all mocked it. Yada, yada, yada…

However, there are some lessons to be learned.

The idea is simple: a person operating in a denied environment has a better chance of surviving if no one identifies them as a person worth watching.

Not invisible…just unremarkable.

The face no one remembers. The person who fit perfectly into the background.

The challenge isn’t dressing for it.

Most people, when they hear “gray man,” think: don’t wear tactical gear in public.

That part is real, but it’s the easy part.

The harder part is behavioral.

What you wear accounts for maybe 20 percent of how observable you are.

The other 80 percent is what your body does when your brain is on high alert.

When your threat recognition system activates, your body responds in ways you can’t fully control: elevated muscle tension in the jaw and shoulders, slight dryness in the mouth, a measurable increase in scanning speed when your eyes move through a space.

None of this is dramatic, but it’s readable to anyone who knows the pattern.

And the people most likely to be scanning for these signals are the people you’d most want to avoid drawing attention from.

There’s a second problem. Going gray isn’t a static state.

It requires constant calibration to the specific environment you’re in…what the baseline behavior looks like, who belongs, and how belonging is expressed.

Fail that calibration, and you’re visible regardless of what you’re wearing.

The full breakdown, including the three behavioral signals that make alert people visible and the specific calibration framework for going gray in real environments, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

You probably saw the photo. Tailored suit, Crye Precision backpack, expressionless face.

In his hands: an HK MP7 personal defense weapon, Aimpoint T2 on a Unity FAST mount, SureFire XVL2-IRC forward, collapsible foregrip.

The agent deployed it during the April 25 breach attempt at the White House Correspondents’ Dinner after Cole Thomas Allen showed up to the Washington Hilton with a shotgun, a pistol, and knives.

The internet lost its mind, and I get it. That is a genuinely impressive piece of kit, deployed by someone who looked like he knew what he was doing.

But the part that most of the gear conversation missed is more interesting than the MP7 itself.

The question worth asking is not “what is that gun” but “why does that category of gun exist at all, and what does the answer mean for you.”

The MP7 belongs to a weapon category called the Personal Defense Weapon, or PDW. The category was “invented” to solve a military problem that nobody had a good answer to.

In the early 1990s, NATO identified a gap in their force protection. Rear-echelon troops, logistics personnel, vehicle crews, artillery teams, support staff, were issued pistols.

Pistols are better than nothing. They are not much better than nothing against a threat wearing body armor.

A rifle solves the armor problem, but is impractical for troops whose primary job is not shooting: it is bulky, it gets in the way, and most of these personnel are not rifle-trained to a level where the added length and weight actually translates to capability.

NATO’s answer was to define a new requirement: a weapon small enough to carry like a pistol, firing a round specifically engineered to defeat soft body armor at ranges out to 200 meters.

The result was the PDW category, and HK built the MP7 while FN built the P90. Both chambered proprietary high-velocity, steel-core cartridges designed for exactly this purpose.

The MP7’s 4.6x30mm round was engineered from the ground up to punch through NIJ Level IIIA soft armor, the same standard that covers most concealable vests, while keeping recoil and platform size manageable.

The gun collapsed is about 16.5 inches. Loaded, it weighs under five pounds. Rate of fire is around 950 rounds per minute. The round moves fast enough to defeat armor that a 9mm cannot reliably beat.

That is why the agent at the Correspondents’ Dinner was carrying a tool built specifically for a scenario where a pistol may not be enough, and a rifle is not appropriate.

Now let’s talk about the gear on that specific gun, because it is worth understanding why each piece is there.

Aimpoint Micro T2 on a Unity Tactical FAST mount.

The T2 is one of the most trusted red dots on the market for serious use. Battery life is measured in years at normal usage. The lens coating is excellent in low light.

The Unity FAST mount raises the optic high enough that you can get a natural cheek weld on a folded-stock PDW or SBR without craning your neck. That matters when you are deploying a compact platform from a non-standard position under stress.

SureFire XVL2-IRC.

This is a combined white light and infrared laser module. The white light handles positive target identification in low-light environments.

The IR component is for use with night vision, which plainclothes federal protection details carry more often than most people assume.

Running IR in a hotel ballroom seems like overkill until you realize these agents work across wildly different environments, and a single configured weapon beats carrying multiple setups.

The Crye Precision backpack.

This is the piece most people glossed over in favor of the gun. Crye Precision builds gear for people with specific operational requirements and the budget to solve them.

The EXP-series pack has an internal configuration that allows a compact long gun to be staged vertically for a rapid one-handed draw. The exterior looks like a professional’s commuter bag. That is intentional, and concealment is the point.

This setup, from the optic mount height to the IR capability to the carry container, tells you this agent is not improvising. Every component answers a question somebody asked before the event happened.

The Civilian PDW Problem

Here is the honest answer most gear content will not give you: civilians in the United States cannot buy an MP7. The platform is not available on the civilian market. The 4.6x30mm round is not something you can stock at a standard dealer.

What civilians can do is apply the thinking behind the PDW to what they actually have access to.

The PDW concept is not about any specific platform. It is about identifying the capability gap in your defensive setup and finding the right tool to fill it.

For a NATO rear-echelon soldier, the gap was “my pistol won’t stop an armored attacker.” For you, the gap is probably different.

Most civilian defensive setups look like one of three things: a carry pistol, a home defense shotgun or rifle, or nothing.

The gap is usually in the middle. A carry pistol maxes out around 15-17 rounds and is accurate to maybe 25 yards/meters in the hands of an average shooter under stress (I know…results may vary). A rifle or shotgun is not something you can easily always have on your person in a public space.

What fills that gap for a civilian is worth thinking through seriously.

At home

The pistol-caliber carbine is the civilian equivalent of PDW thinking. Platforms like the CZ Scorpion, SIG MPX, B&T APC9, or even a good MP5 clone give you rifle-like ergonomics and accuracy, magazine capacities that substantially exceed a handgun, and calibers that run reliably in a short barrel without the overpressure problems you get with rifle cartridges.

They are maneuverable in hallways. They are easier to shoot accurately under stress than a pistol. They share magazines with your carry gun if you run the same caliber.

For home defense, this is the closest civilian analog to what that agent was carrying.

In a vehicle

The PDW concept for vehicle carry in a civilian context is a compact pistol configured for serious use.

That means a quality red dot, the Holosun 507C or SIG Romeo2 are solid (cheaper) options, a weapon light in the 1,000 lumen or above range, and a consistent carry position where you can access it with your support hand if your primary hand is occupied.

Vehicles are confined spaces with limited movement options. Accuracy at speed matters more than it does in a static shooting position.

On your person

This is where the PDW concept most directly challenges civilian EDC thinking. You cannot carry more gun than your environment allows. But you can carry your existing gun better.

A compact pistol with a red dot and a weapon light is meaningfully more capable than the same pistol without either, at the engagement distances and lighting conditions where defensive shootings actually happen.

Adding a spare magazine(s) addresses the capacity gap that separates pistols from PDW platforms. These are not exotic purchases; they are the civilian equivalent of doing a similar analysis that the agent’s unit did before that event.

What to Do

1. Map the gap in your own setup. Write down what you carry, where you are when you carry it, and what scenarios your current gear cannot handle. That gap is what you need to solve. Do not buy more gear before you know what you are buying it for.

2. If you do not have a weapon light on your carry gun, fix that first. Positive target identification in low light is not optional. The SureFire XVL2-IRC on that MP7 costs a bit of your paycheck. A SureFire X300 Ultra or Streamlight TLR-1 HL on your carry pistol costs significantly less and closes the single most common capability gap in civilian defensive carry.

3. Consider a red dot if your pistol will accept one. The Aimpoint T2 on the MP7 exists because a red dot improves speed and accuracy, especially under stress. The same is true on a pistol. It takes training to run well. That is the point.

4. For home defense, evaluate whether a PCC closes gaps your pistol does not. If you are running a full-size pistol for home defense, a pistol-caliber carbine in the same caliber gives you a meaningful accuracy and capacity upgrade with manageable concessions. It is not the right answer for everyone, but it is worth the analysis. Let’s not forget about those SBR’s….

5. Train to access, not just to shoot. The agent’s Crye backpack is only useful because he has practiced drawing from it. Whatever your carry setup is, practice the draw from the position you actually carry in, under conditions that approximate the stress you might face. Speed of access is a capability multiplier.

The Edge

The NIJ Level IIIA point is worth sitting with for a moment.

The MP7’s round was specifically engineered to defeat soft body armor at the threat level that is commercially available and increasingly common in mass casualty events. That is the reason the platform exists.

Most defensive ammunition for 9mm and .45 ACP is optimized to expand in soft tissue. It was not designed with armor in mind because that was not the assumed threat. Armor-piercing pistol ammunition is illegal for civilian ownership under the Law Enforcement Officers Protection Act.

This is not a reason to panic. It is a reason to understand what your ammunition is and is not capable of, and to recognize that the professionals who built the MP7 were solving a problem that did not exist in civilian contexts a decade ago and is not yet common now.

The threat environment changes. The gear follows. The best time to understand that sequence is before it matters.

The official line was that the threat being raised was “not solely” because of Golders Green. That phrasing is worth sitting with.

When an intelligence agency publicly raises its threat level to SEVERE and immediately clarifies that a terrorist stabbing of two Jewish men wasn’t the main reason, that tells you something.

It means the picture they’re not fully describing is worse than the one they’re willing to describe.

The Joint Terrorism Analysis Centre raised the UK threat level from SUBSTANTIAL to SEVERE on April 30, 2026. SEVERE means a terrorist attack is “highly likely.”

CRITICAL, the level above it, means one is “expected imminently.” The UK hasn’t been at SEVERE since November 2021. That time, it took two separate attacks to get there.

The visible trigger was the Golders Green attack on April 29. Essa Suleiman, a 45-year-old Somali-born British national, stabbed two Jewish men on Highfield Avenue in north London.

Shloime Rand, 34, and Moshe Shine, 76, both suffered serious injuries. Suleiman also attacked a third man earlier that same day.

He was Tasered at the scene, charged with two counts of attempted murder and possession of a bladed article, and remanded in custody. The Metropolitan Police declared it a terrorist incident.

That’s the incident the coverage led with. But JTAC’s language pointed somewhere broader.

Officials cited a “gradual rise in threats over time,” driven by increased volume, breadth, and complexity across multiple ideologies.

That’s counter-terrorism language for: more cases, more planning activity, and different kinds of people doing it.

The specific threat environment includes rising Islamist terrorism (still the primary threat), a documented increase in Extreme Right-Wing Terrorism from individuals and small groups, and an elevated threat to Jewish and Israeli targets tied to the ongoing Middle East conflict.

Three separate threat streams, all trending up simultaneously.

JTAC doesn’t raise to SEVERE because of one incident. They raise to SEVERE because they’ve been watching a threat picture build for months and decided the gap between what’s assessed privately and what’s communicated publicly had become untenable.

The 2021 comparison is the most useful data point, but most coverage ignored.

The last time the UK hit SEVERE was November 2021. It took two separate incidents to get there: the Liverpool Women’s Hospital car bombing on Remembrance Day, and the murder of MP Sir David Amess, stabbed in his constituency surgery.

Two unrelated attacks within weeks of each other, different ideological backgrounds. JTAC raised to SEVERE and dropped back to SUBSTANTIAL in February 2022, roughly three months later.

The difference now: officials are not framing this as a reaction to a specific attack. They’re describing a sustained build.

The Golders Green attack gave them a public reference point, but the intelligence basis for the raise was already there.

That distinction matters. In 2021, the raise was responsive. Two attacks happened, the threat level reflected the post-incident environment.

In 2026, the raise is anticipatory.

The cases, planning activity, and radicalization pipeline had already justified a higher designation before the attack occurred. The attack gave JTAC a moment to communicate it publicly, but didn’t create the justification.

Anticipatory raises are harder to walk back. JTAC doesn’t lower the level until the intelligence picture clears.

The factors they cited, volume, breadth, complexity, multiple ideologies, don’t resolve quickly.

The targeting pattern is the other element mainstream coverage is underweighting.

Three of the threat streams JTAC identified are converging on the same target set: Jewish and Israeli individuals and institutions.

Islamist-motivated actors, ERWT actors, and state-linked threat activity are all producing elevated threat to Jewish communities, though for different reasons.

Islamist actors tied to Gaza-related radicalization. ERWT actors operating on longstanding antisemitic ideology. State-linked activity tied to Iranian intelligence targeting Israeli diaspora.

Golders Green was one of London’s most visibly Jewish neighborhoods. The arsons on Jewish-linked premises that preceded the stabbing were part of the same targeting pattern, multiple prior arrests, and a sustained campaign against Jewish institutions that has been escalating toward direct violence.

For anyone operating near these communities, that concentration of threat from multiple unrelated threat actors on the same physical spaces is an operational risk factor that doesn’t appear in generic threat level guidance.

The official “be alert but not alarmed” messaging is designed for the general public. It’s not designed for people trying to make actual risk decisions.

What to Do

1. If you’re traveling to the UK in the next 60 to 90 days, raise your baseline awareness posture, not your alarm level. SEVERE changes the probability calculus of a bad event, not the behavior you’d use to respond to one. Know your exits. Reduce time in transitional spaces. Pay attention to anything drawing police attention before deciding whether to stay or move.

2. If you work with or support Jewish community organizations, institutions, or events, treat the UK targeting pattern as a leading indicator. The same converging threat streams, Islamist radicalization, ERWT, and state-linked intelligence activity, are active in multiple Western countries. UK threat levels often surface formally a few months before the same patterns show up elsewhere.

3. Pay attention to soft targets adjacent to Jewish and Israeli-linked venues. The pattern in the UK has been primary targets absorbing security upgrades while the attacks happen on the streets around them. Highfield Avenue is a residential street, not a secured facility. The hardening of the obvious target pushes the violence one step outward.

4. Separate the SEVERE designation from the Golders Green media cycle. The news coverage will move on. The JTAC assessment is based on an intelligence picture that hasn’t changed. Check MI5.gov.uk for updates, not news headlines.

5. If you’re building or advising security programs for Jewish community organizations in the US, this threat environment is a documented, official, sourced reference point for current risk conversations with leadership. The UK data is real and applicable to that conversation right now.

The Edge

The Golders Green reporting largely skipped over one detail: Suleiman attacked a third man earlier the same day, at a different location. That matters.

He was already in an active threat state before the primary attack. His violence didn’t suddenly escalate from zero…it had already started.

The pre-attack indicators existed but played out on a different victim, in a different location, before law enforcement could connect the sequence.

That’s a pattern with implications beyond this specific case.

When a threat actor is already in motion, the first event in the sequence often doesn’t present as terrorism. It looks like a street assault.

The information processing gap between “street crime” and “active terrorist” is real, and it costs response time.

If you’re in a high-threat environment and you hear about a nearby assault before any larger incident, that’s a data point, not background noise.

The tornado is gone before you can fully process what happened. Ninety seconds, maybe less. Then it goes quiet in a way that doesn’t feel right.

You’re in the closet, or the bathroom, or wherever you went. You’re okay. Now you open the door.

What comes next is where most tornado injuries actually happen. Not the tornado itself. The aftermath. You’re in the dark. There’s drywall dust and insulation in the air. You smell something you can’t quite place. The hallway looks wrong.

Whether you handle the next 60 minutes well or badly comes down to one thing: what’s in that shelter space with you right now.

The kit stored anywhere else is useless.

Most people who have a tornado kit keep it in the garage, a utility room, or stacked in a hall closet.

That works for a drill. In a real event, the space between your shelter and that kit may be blocked by debris, collapsed walls, or exposed structure.

You may not be able to get there. You definitely can’t get there safely if the building took a direct hit.

Everything below goes in the shelter space. Not near it. In it. If it doesn’t fit, prioritize until it does.

One more thing before the kit: know the difference between a watch and a warning.

A tornado watch means conditions are favorable and a tornado is possible.

A tornado warning means one is confirmed on the ground or radar-indicated.

When a warning is issued for your location, you have minutes at most. You go to the shelter, you close the door, and the kit is already there.

What goes in the kit, and why

Break it into three groups: immediate survival, protection, and the hours after.

Immediate Survival (First 60 Minutes)

Hand crank weather radio

Our phone may work after a storm. It may not, cell towers take damage. Even if service holds, the battery won’t.

A hand-crank radio gives you NOAA broadcasts, weather updates, and emergency alerts without needing power or a charged device. This is the one item you should not cut.

Flashlight with extra batteries and a headlamp

You want your hands free when you’re moving through debris. Use the headlamp for work, the flashlight as backup. Both go in the kit with batteries already installed.

First aid - real first aid

Drugstore kits handle splinters. They are not built for trauma. If you’re moving through debris with exposed structural material, lacerations and puncture wounds are realistic outcomes. Add QuikClot or hemostatic gauze, a tourniquet, and wound closure strips. Take a Stop the Bleed course before you need to use any of it.

Whistle

If the structure collapses around you and you can’t move, a whistle carries farther than a voice and requires almost no energy. Put one in the kit. Put another on a keychain for each person in the household.

Protection

N-95 masks for every person

Tornadoes pull everything into the air: insulation, mold, asbestos from older structures, and chemicals from garages and storage areas. The air after a structural event is not clean. Put a mask on before you start moving.

Heavy leather gloves

Roofing nails, broken glass, splintered framing, and moving debris with bare hands are how a survivable event becomes a serious injury. Gloves go in the shelter kit, not in the garage.

Fire extinguisher

Gas lines break. Electrical shorts happen. A fire starting inside a compromised structure spreads fast because the walls are already open. Keep a small extinguisher in the shelter space and know how to use it.

Gas shutoff wrench or channel lock pliers

If you smell gas after the storm, you need to shut it off at the meter. You need a tool to do that. If your usual tool was in the garage and the garage is gone, you don’t have a tool. Dedicate a pair to the kit.

Clothes and shoes for everyone

This one gets skipped constantly. If you shelter in pajamas and your bedroom is destroyed, you’re going to walk through broken glass and debris in socks. Pack a sturdy pair of closed-toe shoes and a basic set of clothes for each person.

The Hours After

Water, one gallon per person in small consumer-size bottles.

Municipal water is often contaminated or offline after a major event. Small bottles fit better in a confined shelter space and are easier to ration.

Snacks, one day per person

You’re not building a long-term cache. You’re building for the period between the storm and when you can assess and move. One day of calories per person is the right scope.

Emergency blankets

If the structure is open to the sky, temperature becomes a problem faster than most people expect. Mylar blankets pack flat and provide real warmth.

Ponchos or contractor trash bags

Waterproofing matters for rain exposure after the storm and for keeping debris out of open wounds while you move.

Hand sanitizer and toilet paper

Post-disaster sanitation gets overlooked. Sewage infrastructure often takes damage in tornado events. Plan for it now.

Cash

If regional power is out, ATMs and card readers are down. Cash gets you gas, food, and lodging.

Local maps

Cell service and GPS are unreliable in major storm events. A paper map of your county is cheap insurance.

Extra car key and house key

If your primary set is buried in debris, you need a backup.

Special supplies

Medications, diapers, hearing aid batteries, mobility aids…whatever your household needs in the first 24 hours belongs in this kit.

Pet supplies

Food, water, a bowl, and a leash. A stressed dog loose in a debris field is a problem you don’t need. Address it before the storm.

Before You Call This Done

The kit assembled and never practiced is a box full of guesswork. Run the scenario once with your household. Everyone goes to the shelter space on a normal afternoon. Where does everyone fit? Can you access the kit in the dark? Does everyone know what the whistle is for?

Also, keep a NOAA Weather Radio in your primary living area, not just the shelter space. The shelter kit handles what comes after. The radio handles the warning that gets you there in time.

What to Do

1. Identify your shelter space today. Small, windowless, interior room on the lowest floor. Decide now.

2. Move the kit into that space today. If it doesn’t fit, start with the priorities: water, first aid, flashlight, radio, masks, gloves, shoes, cash.

3. Add a tourniquet and hemostatic gauze to your first aid kit. Take a Stop the Bleed course before you need them.

4. Put a whistle in the shelter kit and one on each person’s keychain or bag.

5. Run a shelter drill with your household before storm season. Know where everyone goes and in what order.

One more thing

The item most people skip is the shoes.

After talking with people who have been through tornado events, one pattern consistently comes up: the injuries that happened during recovery, not during the storm itself.

People walking through debris fields to check on neighbors, find pets, or reach their cars…in socks, sandals, or bare feet. The tornado lasts 90 seconds. The debris field is hours. Pack the shoes.

The decision to target a home doesn’t start on your street…it starts at a keyboard.

Before a burglar, stalker, or bad actor ever puts eyes on your physical address, there’s a good chance they already know what your front door looks like, whether your fence has a gate latch on the inside or outside, where your vehicles are typically parked, and whether there’s camera coverage on your entry points.

They know this because you showed them. Not intentionally…but the information is out there, it’s free, and it takes about four minutes to access.

Google Street View is the most visible piece of this, but it’s not the only one.

Understanding the full picture of what someone can learn about your home from a computer is the first step toward doing something about it.

The full breakdown…including who is actually using these tools and why, what Street View blurring actually does (and doesn't) accomplish, and five specific actions to reduce your home's open-source exposure…is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

There are two ways to lose the ability to fight. One is injury.

The other is a slow, comfortable, decade-long process that most people never see coming because nothing ever hurt badly enough to make it obvious.

Roosevelt wrote about this at the civilizational level. He named it: materialism, luxury, safety, sentimentality.

Each one removing a demand. Each removed demand allowing a capability to atrophy.

Until there’s nothing left to draw on when something outside the system requires it.

His warning was about empires. But the mechanism he described works exactly the same way at the individual level, one comfortable decision at a time, and the outcome is the same: a person who was once capable becomes a person who is not.

Most prepared civilians don’t think about this. They inventory gear. They run scenarios. They have a plan.

What the Roosevelt observation suggests is that all of it is secondary to a question most people don’t ask: Are you still capable of executing when the plan is gone, and conditions are bad?

Roosevelt wasn’t writing philosophy…he was documenting a pattern he’d watched repeat across history.

Every civilization that fell to a harder people had first lost something internal, something the historians often record as culture or morale, but is really simpler than that: the willingness and ability to endure difficulty and fight through it.

The process is gradual. It’s almost invisible because it feels like progress.

Comfort is better than discomfort. Safety is better than danger. Convenience is better than friction.

All of that is true under normal conditions. The problem is that preparedness is, by definition, preparation for conditions that are not normal.

The person you are inside a functioning system is not the same person who shows up when the system fails.

The gap between those two versions of yourself is what I’m calling the Softness Gradient. Not softness as a character flaw.

Softness as a measurable loss of capability across specific domains, accumulated quietly through the removal of the conditions that would have maintained it.

The gradient is not binary. You’re not either hard or soft. You’re somewhere on a slope that you’re either sliding down or actively climbing. Most people are sliding without knowing it.

Here’s what the gradient looks like, domain by domain, and how to locate yourself on it.

The full breakdown, including the five specific domains where capability degrades, how to diagnose where you are on each one, and the practical steps to reverse course, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

ISIS just dropped its official newsletter ordering supporters to set fire to churches and synagogues across the US, Europe, Russia, India, and beyond…timed for Easter Sunday (April 5).

This isn’t vague online ranting. It’s in Al-Naba Issue 541…ISIS’s flagship propaganda outlet that serves as doctrine and tactical guidance for its global network of lone actors and affiliates.

The message is clear: Use the “Sydney Heroes” as your model…the December 2025 ISIS-inspired attack on a Hanukkah gathering at Bondi Beach that killed 15 and wounded dozens. Swap guns for accelerant and a lighter, and the template still works: soft target, public gathering, holiday timing, maximum psychological impact.

Why Arson?

It’s the ultimate low-barrier attack. No guns, no bombs, no network needed. Just gasoline from any gas station and basic household items. ISIS knows most of its Western sympathizers can’t build IEDs or get firearms without raising flags…but they can all start a fire.

What the Newsletter Actually Says

“In the face of the tragedy of the closure of the blessed Al-Aqsa Mosque, it is incumbent upon Muslims everywhere to rise up and set fire to the Jewish synagogues scattered across America, Europe, Russia, India, and elsewhere.” It also names sites in the UAE, Syria, Tunisia, and Morocco.

They’re exploiting real tensions around the Al-Aqsa closure (tied to the Iran conflict), while conveniently ignoring that Iranian missile debris has also endangered the same holy sites.

The Real Threat Level

No specific plots confirmed yet…but none were confirmed before Sydney either. This call is now circulating. Every successful low-tech attack gets added to ISIS’s propaganda library and becomes the next template.

What Prepared Citizens Do This Weekend

Easter services are tomorrow. Take these steps today…they take less than an hour:

1. Scout Exits Immediately: When you arrive, identify two ways out that don’t rely on the main entrance. Do it in the first two minutes.

2. Watch the Perimeter: Someone hanging around outside who never comes in is an anomaly on a holiday. Report it.

3. Harden the Exterior Now: Move trash bins, mulch, and anything flammable away from walls and doors. Arson almost always starts outside.

4. Talk to Leadership & Law Enforcement: If you’re involved with your church or synagogue, confirm they’ve received the threat intel and requested extra patrols.

5. Have a Family Plan: Agree in advance…if something happens near the entrance, which direction do we move, and where do we meet?

This is classic ISIS “inspire” strategy: low-cost, high-visibility attacks that rely on individuals who’ve never met an ISIS member. The newsletter is the weapon.

Stay safe. Be dangerous. Don’t let manufactured outrage turn your place of worship into the next headline.

This brief is free. For deeper threat mapping, gear lists, and member-only updates on rising domestic risks, upgrade to paid at preparedbrief.com.

Most people still think foreign espionage happens in movies or faraway embassies. Elsa Johnson’s testimony before the House Committee on Education & the Workforce on March 26, 2026, proves it’s happening in broad daylight on American college campuses…and the targets aren’t always spies or professors. Sometimes they’re undergrads doing basic research.

Johnson, a junior majoring in East Asian Studies and Editor-in-Chief of the conservative-leaning Stanford Review, detailed a multi-year campaign that began in summer 2024.

A man calling himself “Charles Chen”, complete with fake Stanford photos and 100+ mutual followers, slid into her Instagram DMs days after she discussed Chinese recruitment tactics with a Hoover Institution supervisor.

He offered a fully paid trip to China, promises of wealth and fame, and pushed hard to move the conversation to WeChat (where the CCP can monitor everything).

When she took screenshots, he publicly commented in Mandarin on one of her posts demanding she delete them. That kind of real-time knowledge of private chats is not normal stalker behavior.

The FBI later told her directly: “Charles Chen” had no Stanford affiliation. He (or his network) had been using similar fabricated profiles for years to target female students researching sensitive China-related topics.

She was reportedly one of at least 11 victims since 2020. They assessed he was likely working on behalf of China’s Ministry of State Security (MSS).

After Johnson published investigative pieces on Chinese academic espionage at Stanford, first in the Stanford Review, then a first-person account in The Times, the pressure escalated:

• Intimidating phone calls (some switching to Mandarin) that referenced her mother by name

• Emails demanding she delete published reporting

• FBI notification that she was being physically monitored on campus

• Surveillance extended to her family back home

As recently as the week before her congressional testimony, another suspected CCP-linked call came in.

Johnson didn’t mince words: “I fear for my safety and for my family’s safety. The intimidation calls have not stopped.”

Why This Matters for Civilian Preparedness

Read more

Just before 1 a.m. Thursday, two men walked to the back of a mansion in Porter Ranch and smashed through a sliding glass door.

They were on camera the moment they did it. They knew they were on camera. They didn’t care, because they had already planned the next step.

They pulled out a Wi-Fi jammer, activated it, and the home’s security system went dark.

The cameras stopped transmitting. The wireless alarm sensors dropped offline. And two men were standing at a broken rear door on a property that had just been blinded from the outside.

The home belongs to influencer Raven Tracy McEachin, where she lives with Christian “King” Combs. Neither was home at the time. An employee inside the house heard the glass break, recognized it for what it was, and called LAPD.

Neighbors heard it too and initially thought it was a gunshot. Officers arrived, searched the backyard, and took a report. The suspects fled before police got there. No arrests. Nothing stolen.

That is the news version, which is not what you need.

What you need is this: the sliding glass door and the Wi-Fi jammer appearing together in the same entry attempt is a methodology.

LAPD has flagged this combination repeatedly in recent high-end burglary cases across Los Angeles.

These two tactics work together as a sequence, and if your home security setup runs on Wi-Fi, you are vulnerable to the same approach regardless of what neighborhood you live in.

Here is how it works and what to do about it.

Read more

Nine days into the Iran bombing campaign, drones appeared over Barksdale Air Force Base.

Not one drone…waves of them. Twelve to fifteen aircraft per wave, running four hours a day, focused specifically on the flight line where the B-52s sit.

The base issued a shelter-in-place order on March 9. Flight operations halted. Then the order lifted and the drones came back the next day. And the day after that.

The military didn’t say a word publicly for eleven days.

When they did say something, on March 20, Capt. Hunter Rininger confirmed “multiple unauthorized drones” and said they were working with law enforcement. No arrests. No attribution. The FAA deferred all questions to the military.

I want to be clear about what this actually was before we get into it.

The part the coverage buried

A confidential Air Force briefing from March 15 got leaked. Air and Space Forces Magazine and a few others reported on it.

Here’s the detail that should have been the headline everywhere:

The drones were resistant to jamming.

NORTHCOM had deployed its counter-UAS Flyaway Kit to the base. Anduril-built system, includes electronic warfare capability and kinetic interceptors.

This exact kit was used successfully on February 28, the opening day of Operation Epic Fury, to neutralize a drone threat over another strategic installation.

At Barksdale, the jamming didn’t work. Six days of drone activity, electronic countermeasures deployed, and the drones kept flying anyway.

That’s not in most of the coverage.

Here’s why it matters.

Jam-resistant drones aren’t something you build in a garage. This isn’t a modified DJI Phantom with a software tweak.

The anti-jamming capability described in that briefing, combined with non-commercial signal signatures, long-range control links, and custom construction, puts this in the category of state-level or state-supported hardware. Significant engineering. Significant resources.

Operators who knew what countermeasures they were going to face and built for it.

This isn’t the first time this playbook ran

October 31 through November 2, 2025. Kleine Brogel Air Base in northeast Belgium.

Three nights in a row, drones over the facility.

Kleine Brogel stores B61 nuclear bombs under NATO’s nuclear sharing agreement. The Belgian defense minister described what happened in two stages: small drones first, probing the base’s radio frequencies, mapping the electronic signature of the security systems. Then larger drones operating over the facility itself.

Read that again and then look at Barksdale.

Probing runs. Frequency mapping. Multi-day sequential waves. Deliberate maneuvering to avoid having operators direction-found. Swarm saturation of a defended perimeter. The methodology is nearly identical. And nobody publicly connected those two incidents until now. The Kleine Brogel story barely got coverage in U.S. outlets.

Two NATO nuclear sites. Same playbook. Less than five months apart. That’s not a coincidence.

What four hours over a flight line actually gets you

A fly-over gives you a snapshot. A four-hour loiter gives you an operations picture.

Five active days of 12-15 drones over Barksdale’s flight line, focused on where the B-52s are positioned and prepped for missions, gives you enough time to map aircraft parking positions, document maintenance crew shift patterns, watch fuel and munitions loading sequences, track security response times, identify patrol routes, and find sensor blind spots. That’s targeting intelligence.

One more thing on the visible lights. Most serious reconnaissance platforms run dark. There are two reasons you’d operate with lights on over a restricted military installation.

You’re testing how fast security responds so you can map their coverage. Or the lit drones are the visible layer of a two-layer operation, drawing attention up while something quieter and higher runs the real collection.

Either way, it’s deliberate. That’s not how a curious hobbyist operates.

The timing

Barksdale isn’t just a B-52 base. It’s the operational hub for strategic bombers running combat missions under Epic Fury. Aircraft were launching sorties over Iran during the same week someone was mapping the flight line.

That timing has a name. It’s called wartime reconnaissance.

If you want to know what a base looks like when it’s surging, how many aircraft are launching, what the preparation tempo looks like, how crew patterns change under operational load, you watch it during active operations. Not peacetime.

That’s when the information is current and actionable.

Nobody has attributed this publicly. FBI, Louisiana State Police, and federal agencies are all investigating. No responsible party named.

I’m not going to name one either.

What I’ll say is that the anti-jamming capability and the coordination required to run multi-day swarm operations over a defended military installation during active U.S. combat operations narrows the field considerably.

What to do with this

Barksdale has NORTHCOM support, Anduril hardware, 2nd Security Forces Squadron, and the full resources of the U.S. military. Their jamming failed.

Your water treatment plant has a chain-link fence.

That’s not meant to alarm you. It’s meant to orient you to where we actually are on domestic infrastructure defense against small UAS threats.

The gap at Barksdale isn’t an anomaly. It’s a preview of what most critical infrastructure faces with zero dedicated counter-drone capability.

Stop waiting for mainstream coverage to tell you when something significant happens to domestic infrastructure.

The Barksdale incursion ran six days before it was publicly confirmed. Kleine Brogel barely made U.S. news.

Watch what agencies aren’t saying.

The FAA deferred everything to the military. Multiple agencies went quiet simultaneously.

That’s information.

Know what’s near you.

Military installations, power generation, fuel terminals, communications infrastructure. Not because you need to worry about it every day, because proximity to strategic assets changes your risk calculus when the threat environment shifts.

Watch for follow-on incidents.

The leaked briefing expressed high confidence that similar incursions could continue in the near term.

If that assessment is right, and I have no reason to think it isn’t, this story isn’t over.

One last thing.

NORTHCOM Commander Gen. Gregory Guillot testified before Congress around March 17-19. He described what happened at Barksdale as a “small drone incursion.”

Twelve to fifteen drones per wave. Four hours per day. Five active days. Jam-resistant. Over a nuclear bomber base in the middle of a war.

Small.

Someone decided that’s the word the public should use for this.

I’d think carefully about what else is getting the same treatment.

You hear something that doesn’t fit. A crack. A pop. Screaming from a direction you can’t immediately place. People near you start moving fast, but not all in the same direction.

You are standing in the middle of it.

You have heard of Run, Hide, Fight. You know what it means. And right now, with your pulse already climbing, you are standing there trying to figure out which one applies to this exact situation, in this exact space, with partial information and zero confirmation that what you think is happening is actually happening.

That gap…the one between “something is wrong” and “I am moving”...is where most people lose. Not because they’re cowardly. Not because they don’t know the options. Because they’re trying to solve the wrong problem.

Run, Hide, Fight is an options menu. It is not a decision protocol. Nobody ever froze in an active shooting because they forgot that running was an option.

They froze because they couldn’t figure out which door to run to, whether the threat was between them and that door, and whether stopping to hide was smarter than moving.

Those are real decisions with real consequences, and nobody taught them how to make them fast.

The first five minutes of an active threat are not primarily a physical problem. They’re a decision problem.

The person who survives is usually not the most physically capable person in the room. It’s the person who started moving 30 seconds before everyone else.

Here’s how to be that person.

Read more

Cuba's Grid Is Gone.

Here's What 10 Million People Are Learning Right Now…and What It Means for You.

Cuba’s national grid operator announced a complete and permanent failure of the country’s electrical system on March 16, 2026. Not a rolling blackout. Not a controlled outage. A total collapse.

The Turkish powerships that had been keeping the lights on left because the government stopped paying. The oil stopped arriving. The grid stopped running. Ten million people went dark simultaneously.

This is not a storm. There is no “restoration estimate.” There is no utility crew working through the night. The grid is not coming back until Cuba can pay for fuel to run generation equipment it may no longer be able to restart. That could be weeks. It could be longer.

Most prepared Americans have planned for 72 hours of grid-down. Cuba is showing what happens when hour 73 arrives and the power is still off.

Your 72-hour kit is not a grid-down plan. It is a starting point for one.

Read more

On March 12, a man drove a truck loaded with fireworks and gasoline into Temple Israel synagogue in West Bloomfield, Michigan. More than 100 children were inside.

Staff had been trained on exactly this scenario. Security guards shot the attacker dead before he made it through the building.

Children were carried out through windows and reunited with parents at a country club down the road. One security guard was struck by the vehicle. Nobody else died.

Six hours later, at Old Dominion University in Norfolk, Virginia, a 36-year-old man named Mohamed Bailor Jalloh walked into a group of ROTC cadets and their instructor and opened fire.

He killed Lieutenant Colonel Brandon Shah. He critically injured two cadets. Then the cadets killed him with a knife.

Two attacks. One day. Two different states. Two different motivations. Both stopped by people who were present and prepared to act.

The coverage has mostly treated them as separate incidents loosely connected by timing and the broader Iran war atmosphere. That framing misses the more important story.

This post is for paid subscribers. Join Prepared Brief to keep reading.

Read more

Analyst Insight

Two weather systems, one driving heavy snow across the northern continental United States and one pushing a Kona low into Hawaii, have combined to put over 1.3 million customers without power in the current cycle. Ohio is carrying the largest single-state burden at over 500,000 customers affected.

Running parallel to the weather picture, Iran’s domestic telecom network has lost its last partially operational reserve node, collapsing the final layer of its civilian internet infrastructure.

A wastewater spill on the Potomac Interceptor in the Washington D.C. area adds a localized public infrastructure concern.

These events are not operationally connected, but they reflect simultaneous pressure on power, water, and communications systems in multiple geographies during a single monitoring window.

Infrastructure and Grid Alerts

• National Power Outages, Weather-Driven - 1.3 Million Affected: Two separate weather events are responsible for outages across the US. An initial reporting threshold showed nearly 900,000 customers without power, with Ohio accounting for over 500,000 of that total due to the northern continental snow system. An updated count puts the national total above 1.3 million customers, with Hawaii contributing approximately 114,000 due to a Kona low making landfall. No restoration timelines are confirmed in the available feed data.

• Potomac Interceptor Spill, Washington D.C.: An active spill involving the Potomac Interceptor, a major wastewater conveyance line serving the Washington D.C. metropolitan area. This type of event can degrade water quality in the Potomac River watershed downstream of the spill point and typically requires public health guidance on recreational and intake water use. No emergency declaration has been confirmed for this incident.

• Iran Telecom, AS12880 Collapse: NetBlocks confirms a full connectivity collapse on AS12880, a key Iranian telecommunications network that had remained partially online as part of the approximately one percent of infrastructure Iran had held in reserve for state functions. The incident corroborates separate reporting of instability on Iran’s domestic intranet. This marks the loss of the last functional layer of Iran’s civilian internet infrastructure.

Posture: Grid stress is elevated in two separate US regions with no restoration timelines confirmed; the D.C. wastewater spill warrants local public health monitoring.

Extreme Weather and Natural Hazards

• Heavy Snow, Northern CONUS: A snow event spanning the northern United States is the primary driver of the large-scale outages affecting Ohio and neighboring states. Sustained below-freezing temperatures combined with extended power loss create pipe freeze risk and elevated demand on emergency services.

• Excessive Rainfall and Flash Flooding, Hawaii - Kona Low: A Kona low storm system is producing excessive rainfall and flash flooding conditions across Hawaii, responsible for approximately 114,000 customer outages. Kona lows are capable of stalling over the islands and producing multi-day flooding. Island grid restoration involves longer supply chains and fewer redundant assets than mainland grids, making extended outage windows more likely than comparable mainland events.

• Fire Weather, High Plains: Reports indicate active fire weather conditions across portions of the High Plains. Dry fuels combined with sustained winds increase the likelihood of rapid ignition and fast-moving grass or brush fires. Under these conditions, fire spread can accelerate quickly and may outpace standard warning and evacuation timelines for nearby rural areas.

Posture: Three distinct weather hazard zones are active simultaneously across the US and Hawaii; travel, shelter, and evacuation planning is warranted in all three affected regions.

International Flashpoints

• Belgorod, Russia - Multi-Site Energy Infrastructure Strikes: Overnight strikes on Belgorod city and district cut electricity, water, and heat across the region. The regional governor confirmed serious damage to energy infrastructure, with the Luch thermal power plant and multiple other energy facilities confirmed as struck. Civilians in Belgorod are experiencing immediate loss of basic utilities. The strikes occurred despite the region being past its peak cold weather period, pointing to infrastructure disruption as the primary targeting objective rather than cold-weather attrition.

• Iran - Civilian Internet Blackout Deepens to Reserve Infrastructure: The AS12880 collapse extends Iran’s national internet blackout to the last remaining functional layer. Prior reporting in the same feed cycle notes degraded VPN access alongside the reserve network failure. The practical effect is that civilians inside Iran now have extremely limited ability to communicate with the outside world. This is directly relevant to US-based diaspora communities attempting to reach family, and reduces available situational awareness for the broader region.

Posture: Two active infrastructure disruption events affecting civilian populations in Russia and Iran are present in this cycle; communities with family in Iran should treat communication loss as the expected baseline, not the exception.

Supply Chain and Access Watch

• Outage-Related Secondary Disruption Risk: With 1.3 million customers currently without power across Ohio, Hawaii, and parts of the northern US, secondary supply chain effects become relevant if outages extend beyond 24 to 48 hours. Cold chain integrity at grocery and pharmacy locations, fuel pump access at gas stations without backup generators, and refrigerated medication storage are the primary downstream vulnerabilities. No explicit supply disruption has been confirmed in the feed data for this cycle.

Posture: Supply chain stress remains secondary and geographically localized to outage-affected areas; restoration timelines will determine whether this condition develops further.

Signals to Monitor

• If Ohio outages extend past 48 hours, cold storage failures at grocery stores and pharmacies in affected areas become a civilian food and medication access concern

• If the Kona low stalls over Hawaii, flash flood warnings and grid restoration windows should be treated as multi-day events requiring sustained shelter and supply planning

• If the Potomac Interceptor spill volume is confirmed significant, downstream water quality advisories for Washington D.C.-area residents and recreational users should be expected

• If Iran’s remaining state-reserved communication infrastructure experiences further degradation, internal government command communications and civilian access will both approach zero

• If fire weather in the High Plains combines with confirmed strong wind events, rapid ignition and evacuation scenarios become the operative threat for rural residents across that zone

Red Flags

• Total US power outages have exceeded 1.3 million customers with no confirmed restoration timeline from any utility reporting source in this cycle

• Hawaii is experiencing grid failure during an active flash flooding event, creating compounding pressure on an island emergency services and logistics system

• Iran’s domestic telecom reserve layer has collapsed, eliminating the last confirmed functional civilian internet pathway inside the country

• An active wastewater spill on a major Washington D.C. interceptor line is ongoing with no declaration issued and no confirmed containment status available

Preparedness Action Items

• If you are in the Ohio outage zone or northern CONUS snow impact area, confirm your backup heat source is accessible and functional right now; identify your pipe freeze threshold, and know at what point your home becomes unsafe to stay in

• If you are in Hawaii, treat this as a potential multi-day compounding event involving both flooding and power loss; charge all devices immediately, store water in case pressure drops, and identify your local flash flood evacuation route before roads close

• If you are in the High Plains under active fire weather conditions, verify your egress routes are pre-planned and pre-checked; do not wait for an official evacuation order if fire is moving toward your position

• If you draw water from a shallow well or use the Potomac watershed for any purpose in the D.C. area, pause use until the interceptor spill is confirmed contained and cleared

• If you have family or contacts inside Iran, attempt communication now using any method available; do not assume current partial access will persist, given the AS12880 collapse

Preparedness Focus of the Day

Today’s dominant risk is weather-driven grid failure, and the most overlooked vulnerability in most homes is the dependency chain that activates the moment power goes out. A gas furnace still requires grid electricity for the blower motor and igniter. A well pump stops the moment the grid does. Refrigerated insulin has a hard window before it is compromised. Walking through your home’s systems today and identifying which ones fail without grid power produces a concrete action list you can work through calmly, instead of discovering each failure point in the dark during an active outage.

You walked past the same vulnerability three times this week and didn’t know it.

Most people missed it because they were watching the Iran war. That’s exactly why it worked.

Three incidents. Seven days. Three soft targets you move through every single week. A school, a house of worship, and a university building.

Three men who were already here, already documented, already holding valid credentials in some cases. Not foreign fighters crossing a border.

People who became citizens, blended in, and waited for the right moment.

March 10, Spring, Texas. A man named Muhi Mohanad Najm walked into an elementary school through a door a departing visitor didn’t fully close. Full load-bearing vest, taser, and a holstered firearm.

When a staff member asked for ID he couldn’t produce any. He turned and walked out.

Born in Baghdad, naturalized in 2022, holding an active Texas CHL, an expired armed security commission, and claiming $1 to his name at arraignment.

March 12, Michigan. A naturalized Lebanese citizen whose brothers were confirmed Hezbollah members, killed in an Israeli airstrike the week prior, rammed a vehicle into a synagogue, engaged security with a rifle, and died in the fire.

March 13, Norfolk. Mohamed Bailor Jalloh. Former Army National Guard. Previously convicted of providing material support to ISIS. Walked into an ROTC classroom at Old Dominion University, shouted a jihadist declaration, opened fire. Killed on scene.

The mainstream coverage treated these as three separate stories. They are not.

This is where the free brief ends. What follows is the part that changes how you actually move through your daily life.

Read more

The Pacific may not be the quiet security buffer many Americans assume. As U.S. strikes against Iranian targets enter day 12, a law-enforcement bulletin circulated to California agencies referenced an intelligence tip claiming Iran aspired to launch unmanned aerial vehicles from a vessel offshore if the United States conducted strikes. Officials emphasize the information was preliminary and lacked confirmation, specific targets, or timing.

This isn’t speculation. ABC News obtained the memo distributed to police departments at the end of February. Here’s the exact language:

“We recently acquired information that as of early February 2026, Iran allegedly aspired to conduct a surprise attack using unmanned aerial vehicles from an unidentified vessel off the coast of the United States Homeland, specifically against unspecified targets in California, in the event that the US conducted strikes against Iran. We have no additional information on the timing, method, target, or perpetrators of this alleged attack.”

According to officials responding after the report surfaced publicly, the information referenced in the bulletin originated from a single unverified intelligence tip. Law-enforcement alerts often circulate such information to ensure agencies remain aware of potential scenarios even when credibility has not yet been established. Authorities say there is currently no confirmed Iranian threat to the U.S. homeland.

The intel predates the current bombardment. A senior law enforcement source told ABC the 12-day campaign has “severely degraded” Iran’s ability to pull it off. California Gov. Gavin Newsom and local sheriffs are rushing out the usual script: “No imminent threat,” “elevated readiness,” “working with federal partners.” Legacy media buries the ball - “aspirational,” “unverified,” “cautionary.” Classic.

The memo also reignited debate about maritime security along the U.S. coastline. Some lawmakers argue that ongoing political disputes affecting federal agencies could strain resources responsible for coastal surveillance and maritime awareness. Officials, however, have not linked the law-enforcement bulletin to any specific operational gap in Coast Guard or homeland security readiness.

Iran has already proven it can hit cities with these weapons.

Proxy swarms have slammed hotels and infrastructure in the UAE and across the Middle East. Low, slow, cheap, and hard to intercept once airborne, exactly the asymmetric nightmare a vessel a few dozen miles offshore could unleash on Los Angeles, San Francisco, or any coastal target.

Intelligence officials have warned for years about Iranian networks in Mexico and South America pre-positioning gear for exactly this scenario. The memo shows that the scenario was serious enough for law-enforcement agencies to circulate internally, but it does not confirm that any operational Iranian plot exists.

This is a symptom of deeper failures. While the homeland gets hammered by endless wars abroad, the very agencies tasked with watching our own backyard are furloughed and demoralized.

When the next vessel slips through because the Coast Guard is running on skeleton crews and morale is in the toilet, don’t expect the cavalry.

The Hidden Threat Off the Horizon: Why Maritime Awareness and Rapid Bug-Out Plans Save Lives

Urban or coastal crowds create perfect kill zones. Add sea-launched drones, fast, explosive, and swarm-capable, and panic turns deadly in minutes.

The FBI alert proves the intent was there. Government “readiness” statements won’t stop the first wave. Prepared citizens fill the gap.

Here’s how to stack the odds right now:

• Scan the Horizon Daily: Download MarineTraffic, VesselFinder, and local harbor cams. Learn what normal commercial traffic looks like off your stretch of coast. Suspicious loitering vessels (no AIS, unusual patterns) are red flags. With the Coast Guard hampered by the shutdown, you are the early warning system.

• Pre-Position Inland Escape Routes: California’s coastline is target-rich. Map multiple bug-out paths to the mountains or high desert now, not when sirens sound. Drones launched from 50-100 miles offshore still give you minutes to hours, depending on range. Fuel caches, alternate routes, and rally points for family are non-negotiable.

• Read the Signals Before the Swarm: Watch for sudden no-fly zone expansions, cell network glitches, or vague “elevated threat” notices like this one. Iran’s “potential” plan was tied directly to U.S. strikes…we’re in that window. Stockpile offline intel sources (ham radio, shortwave) because mainstream media will still be downplaying it.

• Gear That Actually Matters for Drone Warfare: Lightweight go-bag with N95/P100 respirators (explosive residue and smoke), trauma kit with tourniquets and quick-clot for major bleeding, portable ham radio tuned to Coast Guard and local emergency frequencies, and a quality offline GPS. Add a Faraday bag for electronics. Concealed carry where legal…post-detonation chaos brings looters and secondary threats fast.

• Comms Continuity and Family Drills: Cell towers will overload or get jammed in the opening minutes. Mesh networks, GMRS/FRS radios, or Starlink backups keep your group connected. Run monthly “ threat” drills: grab the bag, load the vehicle, hit the pre-planned route in under 10 minutes.

• Community Network Over Government Reliance: Link up with trusted locals now. When the Joint Terrorism Task Force is busy issuing more memos and the Coast Guard is begging for backpay, your neighborhood mutual aid group is what actually responds.

The Gracie Mansion IEDs fizzled by luck. This Iranian drone plot may have been degraded by U.S. strikes…for now. Next time the regime (or its proxies) gets luckier, or the shutdown drags on longer, or another actor copies the playbook. The pattern is clear: government prioritizes politics and optics over hardened borders and coasts.

Don’t wait for the next alert. Build the plan. Stock the gear. Train the family. Stay informed beyond the headlines.

This brief is free to equip you against rising threats. For exclusive deep dives, gear breakdowns, real-time coastal intel briefs, and member-only threat maps, upgrade to paid on Substack at preparedbrief.com.

Stay safe, be dangerous. The Pacific just got a lot smaller.

Update: Mar 12, 2026

After the memo became public, officials clarified that the bulletin referenced a single unverified intelligence tip and was distributed as a precautionary awareness notice to local law enforcement. Authorities state there is currently no confirmed Iranian threat to the U.S. homeland.

In the heart of Manhattan’s Upper East Side, what started as a tense standoff outside Gracie Mansion on March 7, 2026, nearly turned into a bloodbath.

While legacy media spins it as “suspicious devices” amid “clashing protests,” the reality is stark: Two counterprotesters, inspired by ISIS propaganda, hurled shrapnel-packed IEDs at a group demonstrating against the “Islamification” of New York City.

Shouts of “Allahu Akbar” were reported as the devices, loaded with nuts, bolts, screws, and volatile TATP explosive, were lit and thrown.

By sheer luck, they fizzled out, sparing lives but exposing how quickly urban gatherings can devolve into kill zones when authorities drop the ball.

The facts, pieced from NYPD statements and FBI updates: Emir Balat, 18, lit the first IED and tossed it toward the anti-Islam crowd led by conservative activist Jake Lang.

It struck a barrier at East 87th Street and East End Avenue, landing in the crosswalk with flames and smoke but no full detonation.

Balat then grabbed a second device from accomplice Ibrahim Kayumi (or Nikk), 19, lit it, and dropped it during his escape.

Both Pennsylvania teens were arrested on-site, admitting to ISIS video influence.

A third suspicious device turned up the next day in a linked vehicle blocks away, prompting evacuations and escalating the probe to federal terrorism levels.

No injuries, but NYPD Commissioner Jessica Tisch confirmed the bombs “could have caused serious injury or death.”

This is a symptom of deeper failures.

Mayor Zohran Mamdani, NYC’s first Muslim mayor, condemned the original rally as “bigotry,” but critics argue his administration’s lax stance on extremism invited escalation.

Media outlets like TIME and CNN frame it neutrally as “opposing groups,” burying the terror angle to avoid uncomfortable truths about imported threats.

When the government prioritizes narratives over security, prepared citizens must fill the gap.

The Hidden Threat in Crowds: Why Positioning and Awareness Save Lives

Urban protests create perfect conditions for disaster: Confined spaces, high emotions, barriers channeling people like cattle.

The Gracie Mansion crowd, 50-150 total, was small, but add IEDs, and panic could have triggered a deadly stampede.

We’ve seen it in past events: Barriers become traps, exits clog, and the crowd itself turns lethal.

For prepared citizens, the lesson is clear…don’t rely on police lines or event organizers for safety.

Here’s how to stack the odds:

• Scout Early, Position Smart: Arrive ahead to map escape routes. Avoid the center; stick to edges where you can break away fast. In Gracie, the crosswalk throw created instant choke points…had it exploded, those behind barriers would be sitting ducks.

• Read the Signals: Watch for red flags like unusual shouts (”Allahu Akbar” is a cue) or suspicious movements. Tensions were brewing with verbal clashes; prepared folks would have noted the escalating taunts and edged out.

• Gear Essentials for Volatile Environments: Pack light but effective. A go-bag with water, a multi-tool, flashlight, first-aid (including tourniquets for shrapnel wounds), and a respirator for smoke/chemicals. Concealed carry if legal…defend against direct threats to your life when cops are overwhelmed.

• Exit Drills: Practice “bugging out” mentally. If violence erupts, move perpendicular to the flow, use cover like vehicles or trees, and prioritize family/group cohesion. Don’t linger to film…curiosity kills in crowds.

• Comms Continuity: Cell jammers or overloads are common in chaos; have backups like radios or offline maps. When signals die (as in past blackouts), you’re on your own.

Government won’t always be there…NYPD acted swiftly here, but in a larger crisis, response times stretch.

Build resilience now: Train with your network, stock essentials, and stay informed beyond headlines.

This brief is free to equip you against rising threats. For exclusive deep dives, gear breakdowns, and real-time intel briefs, upgrade to paid on Substack.

You are standing in a crowd of several thousand people. Nothing violent has happened yet.

Music is playing somewhere behind you. People are filming with their phones. Conversations are loud but casual.

Most of the crowd believes the event is winding down. But a few small things have already changed.

Movement has slowed. People are beginning to cluster together.

And somewhere near the front of the crowd someone just threw the first object.

If you stay another five minutes, leaving may no longer be easy.

That is how most crowd violence begins.

Crowds rarely turn violent without warning. What makes them dangerous is not how suddenly violence appears, but how quietly the warning signs begin.

In almost every riot, stampede, or crowd assault, there is a short window where the environment changes in subtle ways. Most people miss it. They assume the situation is still under control.

By the time the danger becomes obvious, movement has already collapsed.

Security professionals watch for specific signals that appear minutes before violence begins. These signals are behavioral changes inside the crowd itself.

They are visible and predictable, and if you recognize them early enough, they give you time to leave.

Scenario

It is late evening in a downtown entertainment district.

A large protest has moved through the area during the afternoon. By nightfall the streets are still packed. Thousands of people are standing in the roadway and spilling onto sidewalks.

At first the atmosphere feels loud but normal.

Music plays from portable speakers. People chant slogans and wave signs. Groups move slowly through the crowd, talking and laughing.

Police vehicles sit several blocks away but have not approached the crowd yet.

Most people assume the event is winding down.

But if you watch closely, the environment has already begun changing.

And the first signal appears.

Signal One

Crowd Compression

Peaceful crowds move.

People drift in and out. Groups shift positions. Individuals walk past one another constantly.

When a crowd is about to turn volatile, that movement begins to slow…then it stops.

People stop walking and begin standing in place.

Heads turn toward the same direction, conversations pause, and phones rise above the crowd as people try to film something happening farther down the street.

Within minutes, the space around you begins feeling tighter.

People who were passing you moments earlier are now shoulder to shoulder.

The crowd has stopped behaving like a gathering.

It has become an audience, and audiences are unstable.

What This Means

This is the moment when most people make a critical mistake.

They assume something interesting is happening and move closer to see it.

But compression is the first stage of crowd danger.

Once the crowd becomes dense enough, individuals lose their ability to move freely.

And once mobility disappears, the environment can become dangerous extremely quickly.

The Moment Most People Miss

Compression is the warning.

The real danger begins when the second signal appears, because that is when the crowd’s emotional tone changes and the situation can escalate in seconds.

Most civilians do not recognize this shift until it is already happening.

Security professionals watch for it constantly.

Because once this signal appears, the safest decision is usually the same:

Leave immediately.

The Second Signal Is the One That Changes Everything

Crowd compression alone does not cause violence.

It only creates the conditions for it.

What actually triggers the shift from tension to confrontation is the moment when the emotional state of the crowd changes.

Security teams sometimes call this the tone shift.

It happens fast.

A crowd that was loud but neutral suddenly becomes synchronized. Voices begin repeating the same chant. Anger spreads outward through the group like a wave.

When that happens, the situation can escalate in seconds.

And once the third signal appears, leaving becomes dramatically harder.

The problem is that most civilians do not recognize these signals until the crowd has already started moving.

Security professionals watch for them constantly.

Because once they appear, the safest decision is almost always the same.

You leave.

Immediately.

Most people don’t.

And that is where the real danger begins.

Read more