Google quietly decided that refusing to run their software is evidence of fraud.

At Cloud Next in April 2026, Google announced “Cloud Fraud Defense” and called it the next evolution of reCAPTCHA. The old puzzle is gone.

When the system flags your traffic as suspicious, you get a QR code. Scanning it requires Google Play Services running on your device.

If you removed Play Services because you read what it does, you get locked out.

Internet Archive records show this requirement has been running since at least October 2025. Seven months of deployment before anyone noticed.

The people most likely to understand Google’s data practices are now being flagged as fraudulent for that understanding.

This is not the first time.

In 2023, Google proposed “Web Environment Integrity”, a system that would let Google decide which devices were “real enough” to access the web.

Standards bodies and the public pushed back hard enough that Google killed it publicly.

Three years later, the same idea is running inside reCAPTCHA, deployed to millions of websites whose developers haven’t changed a thing.

There was no standards process to observe. No public comment period. It was deployed and stayed deployed for seven months.

Your phone is the most capable surveillance device you own.

Stock Android gives Google root-level access to your location, contacts, call logs, and app activity by default.

The carrier layer adds its own collection on top of that. What you get in exchange is a convenient device that someone else controls.

The alternative has existed for years, and it runs on hardware that costs $100 or less. And installing it is more straightforward than most people assume.

Read more

Most people think license plate readers are a car problem. Cover your plate, swap your vehicle, borrow a friend’s car…and you’re off the grid.

That may not be enough…

A $17 billion Italian defense contractor called Leonardo quietly patented a system in March 2024 that clips sensors directly onto existing license plate reader hardware.

The sensors don’t read your plate as you would think…they read your phone, smartwatch, AirPods, and your car’s tire pressure sensors.

Every device you travel with that broadcasts a wireless signal gets logged, correlated, and stored.

Over time, the specific combination of devices you carry becomes a unique electronic fingerprint…one that can identify you and your vehicle even when there’s no plate to read.

The system is called SignalTrace. And the infrastructure it runs on is already everywhere.

What SignalTrace Actually Is

Leonardo US Cyber and Security Solutions, a subsidiary of Leonardo S.p.A., Italy’s largest defense company, markets SignalTrace as an add-on to its existing ELSAG license plate reader platform.

The ELSAG system already operates in thousands of jurisdictions across the United States. SignalTrace basically upgrades these readers.

The patent, US 11,941,716 B2, titled “Systems and Methods for Electronic Signature Tracking,” describes a system that captures device-frequency activity from passing vehicles and correlates it with plate data inside a centralized system called the ELSAG Enterprise Operations Center (EOC).

Everything gets timestamped, geotagged, and indexed for later search.

The device categories Leonardo’s own product sheet lists include: RFID tags, Bluetooth devices, vehicle components, and Wi-Fi sources.

The specific examples: key cards, asset tags, pet microchips, mobile phones, watches, fitness trackers, wireless headphones, tire pressure sensors, infotainment systems, vehicle hotspots, tablets, smartphones, and laptops.

Leonardo’s position is that the system captures publicly broadcast signals and doesn’t decrypt communications content.

That’s technically accurate. It’s also beside the point.

The Part Most Coverage Is Missing

The privacy argument people are having about SignalTrace focuses on whether capturing your Bluetooth ID is legal.

That argument matters, but it’s the wrong place to focus if you’re thinking about your own exposure.

Here’s the thing that should get your attention: your car itself is broadcasting.

Tire Pressure Monitoring Systems (TPMS) have been federally mandated on all vehicles sold in the United States since 2008. Each tire sensor broadcasts a unique identifier every few seconds when the vehicle is in motion.

That signal doesn’t require your phone or your Bluetooth to be on.

It actually doesn’t require any action on your part.

The full breakdown, including the specific signals your vehicle broadcasts independently of any device you carry, what the current legal landscape actually allows, and five concrete steps to audit and reduce your electronic signature, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

You’ve driven this road a hundred times.

Google Maps shows it clear. Three blocks in, you see a crowd standing in the lane.

You slow down. Someone slaps the hood. Someone else steps in front of the vehicle.

You’re now in the middle of a road blockade near a federal detention facility with cars behind you, no room to turn around, and no plan for what comes next.

That’s the exact situation multiple drivers found themselves in on Doremus Avenue in Newark over the past three weeks.

One driver crept forward slowly. Someone in the crowd threw an object that cracked the windshield. At another exit, a car got completely surrounded.

Down the street, a news crew parked on the shoulder ended up inside a cloud of tear gas when law enforcement moved in to clear the road.

None of those people chose to be there. They drove into it because they didn’t have a system for knowing it was there before they left.

Delaney Hall is a federal immigration detention facility in Newark, New Jersey, operated by GEO Group under contract with ICE.

In late May 2026, protesters began demonstrating outside and escalated quickly to road blockades, projectiles thrown at police and civilian vehicles, and nightly clashes with law enforcement.

Newark imposed a curfew: 9 p.m. to 6 a.m., half-mile radius, Doremus Avenue closed to non-essential traffic. Hundreds were arrested over two weeks for violations.

Similar disruptions have hit other ICE facilities around the country. June 14 has large-scale demonstrations planned in multiple cities.

The curfew was publicly announced and widely covered locally. People still drove into it.

That’s what happens when you don’t have a pre-movement check built into your routine.

Protest zones don’t hold still. The blockade on one street at 8:30 is at a different intersection by 9:05.

The crowd that was two blocks away when you entered is surrounding your vehicle when you try to leave. By the time any of that registers, you’ve already burned your best option.

Here’s how to build a system that keeps you out of that situation, and what to do if you end up in it anyway.

Before You Leave: The Pre-Movement Intelligence Check

This takes three minutes. Do it every time you’re moving through an urban area with known or potential unrest.

The full breakdown, including the three-minute pre-movement intelligence check that would have kept drivers off Doremus Avenue, the step-by-step vehicle protocol when you're already surrounded, and exactly what to carry for this threat profile, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

When FBI agents walked into David Rush’s Fairfax County home last week, they found 308 one-kilogram gold bars worth north of $40 million, $2 million in cash, and 35 luxury watches.

The news coverage focused on the gold, but the watches are the more interesting detail.

Anyone who has spent time around intelligence operations, financial crime, or serious money laundering knows what a collection of 35 luxury timepieces means.

Gold is heavy and traceable.

Cash is bulky and has a weight problem; a million dollars in hundreds runs over 22 pounds.

But a single Rolex Daytona can hold $30,000 to $50,000 in value on your wrist, clears customs without a second look, and converts to cash in any city on earth with minimal friction.

Thirty-five of them represent a million dollars or more in highly portable, essentially unregistered value.

What Actually Happened

David Rush held a Senior Executive Service-level position at the CIA with a top-secret/SCI clearance.

Between November 2025 and March 2026, he requested and received from the agency “a significant quantity of foreign currency and tens of millions of dollars in gold bars for work-related expenses,” according to an FBI agent’s affidavit.

The CIA then conducted its own review and “was unable to locate the gold bars or significant amounts of the foreign currency.”

It could find no record of Rush ever documenting what happened to any of it.

The FBI searched his house, and they found it all.

But the theft is only one layer of this case.

Investigators found something else: the man directing operations that required tens of millions in untraceable assets had apparently built his entire career on fabricated credentials.

Clemson University told investigators they could not verify Rush attended the school.

Rensselaer Polytechnic Institute had no record of him.

The FAA confirmed he held no pilot’s license, despite listing one on official paperwork.

Per the federal affidavit, Rush also falsely claimed to remain in the Navy Reserve after his 2015 discharge, collecting approximately $77,000 in fraudulent military leave pay.

The fraud stretched from approximately 2009 through May 2026. Seventeen years.

Director Ratcliffe ordered the CIA’s internal investigation.

When it identified probable legal violations, the CIA walked the referral to the FBI.

Rush was arrested on May 19th, and the agency issued a public statement confirming cooperation with the ongoing law enforcement inquiry.

What this case reveals, about how value gets stored by sophisticated actors, about what credential fraud looks like inside a cleared workforce, and about the limits of insider threat detection at the agencies most responsible for catching it elsewhere, goes deeper than what the news cycle is covering.

The Watches Are a Financial System

Cash has a weight problem at scale.

A million dollars in $100 bills weighs just over 22 pounds.

That is manageable for a single exchange, but it becomes a logistics problem when you are moving tens of millions and cannot use the banking system.

Gold solves the weight problem partially, but gold carries its own exposure: it is assayed, sometimes registered, and harder to liquidate quickly without leaving a paper trail.

Luxury watches solve both problems simultaneously.

The value-to-weight ratio on a Rolex, Patek Philippe, or Audemars Piguet exceeds almost any other portable asset outside of gemstones.

A single watch holds tens or hundreds of thousands of dollars in value.

It crosses international borders on your wrist without a declaration requirement.

It converts to cash through any of thousands of unregulated gray-market dealers worldwide.

Unlike gold, there is no registration system for timepieces. Unlike cash, there is no bulk. Unlike art, they are liquid.

NBC’s on-air reporting noted that Rush was “paid in cash and watches” for his operational work before those assets were supposed to be used to fund operations he was running.

That detail matters. Being paid in watches is a documented methodology used by transnational criminal networks, intelligence services, and corrupt officials to move and store value outside monitored financial systems.

In 2015, a DEA investigation revealed that Hezbollah purchased approximately 14 million euros in watches from a single retailer in Germany, then transported them by couriers to Lebanon for conversion to cash.

Dutch law enforcement subsequently urged watch dealers to refuse cash transactions after multiple investigations linked luxury timepieces to money laundering networks across Spain, the Netherlands, Romania, and Belgium.

The mechanism is always the same: placement of illicit funds, layering through purchase-and-resale cycles, and integration back into the financial system through what appear to be legitimate transactions.

Rush having 35 watches alongside 308 gold bars is a recognizable inventory.

Gold for bulk storage and watches for portability and liquidity.

Both outside the monitored financial system.

The Ghost at the Clearance Level

The theft is comprehensible.

A man with access to covert funds diverted them. That happens.

The institutional failure that made it possible is the harder problem.

Rush held SCI clearance, one of the most access-restricted security designations in the U.S. government, for the better part of seventeen years on the basis of credentials that apparently did not exist.

The background investigation process for SCI clearances is designed to be exhaustive: detailed personal history interviews, records verification, financial reviews, polygraph examinations, contact verifications, and ongoing periodic reinvestigation.

It exists specifically to identify exactly this category of deception, and somehow it missed all of it.

Clemson had no record, RPI had no record, the FAA had no record, and the Navy Reserve fraud only surfaced during the broader criminal investigation.

None of the standard screening machinery caught, over seventeen years, a man who appears to have constructed his career entirely on a fabricated background.

This is what intelligence professionals call a ghost, someone who holds real access and real authority on the basis of an identity that is not fully real.

Ghosts appear in the operational record with uncomfortable regularity.

Robert Hanssen passed multiple polygraphs and operated inside the FBI for over two decades before his arrest.

Aldrich Ames passed CIA polygraphs repeatedly during the years he was selling intelligence to Soviet handlers.

Both men held their positions in plain sight.

Rush is not alleged to be a foreign asset, and the current charges are theft and fraud.

But the credential fabrication raises a question that the theft charges alone do not answer: if his professional background was substantially invented, what was he actually doing in the positions he held?

What operations did he direct?

Who authorized the disbursements?

The investigation continues.

The Ratcliffe Signal

The CIA self-surfaced this case, and that is worth naming directly, because it represents a departure from the institutional default.

The historical pattern at agencies with counterintelligence equities has been internal resolution.

Protect sources, methods, and institutional reputation. Manage exposure.

The Ames investigation dragged on in part because both the CIA and FBI had structural incentives to minimize the damage rather than fully trace it.

The FBI’s internal handling of the Hanssen case showed similar reluctance at critical junctures.

Ratcliffe ordered the investigation, identified probable legal violations, and referred the case to the FBI.

The agency issued a public statement confirming cooperation.

That sequence, and the public posture around it, is not how these cases have typically proceeded.

Whether this represents a genuine shift in how the CIA handles internal accountability, or a calculated move tied to the current administration’s reform posture toward the intelligence community, is a question the prosecution’s outcome will help answer.

The indictment will specify charges and evidence.

What happens between the arrest and the verdict is worth watching.

The Edge

The hardest question in the Rush case is not how he stole the money.

The harder question is what else was happening in the same operational space that a man with fabricated credentials was directing.

Covert finance operations at this scale are tightly compartmented.

The people above Rush in the chain of command authorized the disbursements.

The oversight mechanisms that exist to audit exactly this kind of activity apparently did not catch it for years.

What the CIA’s internal audit found will eventually surface in the prosecution.

What falls under continuing operational sensitivity and never reaches public disclosure is a harder problem.

Not a conspiratorial one…just the ordinary reality that highly compartmented programs have very few people who can actually audit them, and the people most capable of doing it often have the most institutional incentive to minimize what they find.

The investigation continues…pay attention to what the indictment says when it comes.

Philip Siefke bought a Toyota RAV4 in 2021. He never signed up for a driving data program. He never agreed to let anyone track his speed, his braking, his cornering, or where he went.

In January 2025, he tried to get a new insurance policy with Progressive. During the online signup, he specifically opted out of Progressive’s Snapshot program…the one that tracks your driving and adjusts your rate accordingly. He declined and clicked the "no" button.

A popup appeared, and it told him Progressive already had his driving data.

He had never given it to them.

What Siefke found out the hard way is something most American drivers still don’t know: opting out of your insurance company’s data collection program does nothing if your car manufacturer already sold your driving history upstream.

The data left without his consent before he ever sat across from an insurance form. By the time he clicked “decline,” the transaction was already done.

How Your Car Became a Surveillance Device

Modern connected vehicles are rolling data collection platforms.

Every car sold in the last several years with a cellular connection, a smartphone integration system, or a manufacturer app is generating a continuous stream of information: your location, your speed, how hard you brake, how fast you accelerate, how sharply you corner, whether you wear your seatbelt, what time you leave, and where you go.

That data does not stay in your car. It transmits to your manufacturer’s servers, and from there, depending on which automaker you drive and which connected services you use, it moves into a pipeline that runs through data aggregators, consumer reporting agencies, and eventually to your insurance company.

The companies in the middle of that pipeline, LexisNexis Risk Solutions and Verisk are the two largest, are not household names.

But they are the reason your insurance premium can go up without you ever filing a claim, getting a ticket, or being in an accident.

They build driving behavior profiles from manufacturer-supplied telematics data and sell access to those profiles to insurers.

A 2024 analysis found that drivers flagged in LexisNexis telematics reports paid between 12 and 21 percent more on average than drivers without those flags.

One 65-year-old driver of a Chevy Bolt saw his premium jump 21 percent.

When he shopped around for better rates, every insurer quoted him high…because every insurer was pulling the same LexisNexis report.

He had not been in an accident and had not received a ticket. His car had been talking about him.

One driver who requested his LexisNexis disclosure file found a report documenting 640 individual trips…with start and end times, distances, speeds, hard braking events, and fast acceleration.

He had not signed up for any program and had not consented to any monitoring. His manufacturer had simply been transmitting.

The Cases That Made It Visible

Three enforcement actions in the last 18 months have put specifics on what was previously buried in terms of service.

GM and OnStar. General Motors ran a program called Smart Driver…marketed as a free feature inside its connected car apps that tracked driving behavior and rated it.

The pitch was improvement and safety.

The reality was that GM was selling that data to insurance companies and consumer reporting agencies without clear disclosure or meaningful consumer consent.

The FTC finalized a settlement order in January 2026. GM and OnStar are now banned from sharing driving data with consumer reporting agencies for five years.

For the next 20 years, GM must obtain affirmative express consent before collecting, using, or sharing any connected vehicle data.

The company was also required to delete or destroy previously collected driver data. GM paid $12.75 million in a separate civil settlement.

Allstate and Arity. Allstate’s data analytics subsidiary Arity built what the company described as the world’s largest driving behavior database…collecting data from 45 million Americans.

The method: Arity paid third-party app developers to embed tracking software inside apps that had nothing to do with driving or insurance (GasBuddy, Fuel Rewards, Routely).

Drivers who downloaded these apps to find cheap gas or earn fuel points were unknowingly transmitting their driving behavior to an Allstate subsidiary, which used the data to justify raising premiums, denying coverage, or dropping policyholders entirely.

Texas Attorney General Ken Paxton filed suit against Allstate and Arity in January 2025…the first enforcement action ever brought under a state comprehensive data privacy law.

A federal court has also kept wiretap and Fair Credit Reporting Act claims alive in a related class action.

Toyota and Connected Analytic Services. The Siefke lawsuit, filed in April 2025, names Toyota and Connected Analytic Services (CAS), a consumer reporting agency and data aggregator, for collecting location, speed, direction, braking, swerving, and image and voice data from Toyota vehicles and sharing it with Progressive, marketing agencies, law enforcement, and auto finance companies.

The plaintiff’s experience, opting out of a data program only to be told the data was already in the insurer’s hands, is the clearest illustration of how this system is designed.

Consent is offered downstream, after the collection has already happened upstream.

The full breakdown, including which specific manufacturers and apps are confirmed feeding data into insurance pipelines right now, what your LexisNexis driving file contains and how to request it, and the five specific steps to limit what your car reports, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

Robert Jay Josett was placed on administrative leave from the Costa Mesa Police Department in December 2023. His department had figured out he was using police databases to track his mistress, her boyfriends, and his own wife. The investigation was underway, and the case was building.

Six months later, he logged into Flock Safety and pulled the new boyfriend’s address in Torrance.

He was a suspended officer, under investigation, with no active cases and no legitimate reason to touch the system. He accessed it anyway, and the system let him right in.

That detail…a cop who had already been caught, already been suspended, accessing a nationwide surveillance network without anyone stopping him is the thing you should not be able to stop thinking about.

Because the entire sales pitch for Flock Safety, a company now valued at $7.5 billion, is built on the claim that its systems have controls. That the access is secure. That only authorized users with legitimate purposes can query a network of over 64,000 cameras spread across the country.

Josett was not authorized. He had no legitimate purpose. He got in anyway.

What Flock Actually Is

Flock Safety sells cities what it calls a public safety platform. The core product is a network of AI-powered cameras that read license plates and transmit that data to a centralized cloud database hosted on Amazon Web Services.

Every camera captures every vehicle that passes it. The data is queryable by any law enforcement agency that subscribes.

That last part is important. The database does not belong to your city. It does not sit on a government server that your city controls. It lives on Flock’s private cloud.

That means public records laws, FOIA requests, and municipal oversight mechanisms do not reach it. Residents in any city using Flock have no direct public records access to what was searched, when, by whom, or why.

The network enables cross-jurisdictional queries. A cop in one state can search vehicle movements across the entire Flock network, covering hundreds of jurisdictions, from a desk.

If enough cameras cover your neighborhood, your commute, and your daily stops, a motivated analyst can build an accurate picture of your life without ever leaving the office.

Where you live. Where you work. What time you drop your kids off. What businesses you visit. All of it attached to your plate, which is attached to your name.

Josett used this to track a woman and the men in her life.

Between June and December 2023, he made 13 inquiries into the CLETS database on people unrelated to any active case.

He used Flock to locate specific vehicles.

He contacted his mistress more than 100 times in a single day over a nine-month stretch, via text, phone calls, and social media.

When the department put him on leave, the Flock system should have cut his access.

It did not. Or if it did, it failed to hold.

He pleaded guilty in April 2026 to three misdemeanors: unauthorized computer access and fraud, repeated harassing phone calls, and contempt of court for violating a restraining order.

He received three years of probation and was ordered to complete a 52-week domestic violence program. No felony charges.

This Is Not One Bad Officer

The Institute for Justice has documented at least 16 cases, nationwide, of officers using ALPR systems to stalk romantic partners, ex-partners, or rivals.

These are only the cases that made the news. The list includes:

• A Riverside County, California deputy who tracked a friend’s vehicle through the department’s Flock system.

• A Milwaukee officer who queried a woman and her ex-partner nearly 180 times over two months.

• An Orange City, Florida cop who searched an ex-girlfriend’s family more than 100 times over seven months.

• A Monroe County, Florida sheriff’s deputy who pulled over a woman he met on a TV set by running her plate and then tracking her movements.

Nearly all of them were eventually charged and fired. But the critical question is not how many got caught…it’s how many didn’t.

Every law enforcement officer in every agency with a Flock contract has the ability to run queries on any plate in the network.

Most departments have weak or nonexistent audit log review. Some have no audit function at all.

The system relies on the honor system, enforced occasionally after the fact when misconduct becomes visible enough to investigate. That is not access control, it is the appearance of access control.

The full breakdown - including the Palantir data pipeline that routes your movements to federal agencies, the confirmed cases of ICE and Border Patrol querying local Flock data, the cities that have already canceled contracts after discovering unauthorized federal access, and the practical steps to find out if you’ve been searched - is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

Your phone has three microphones, two or more cameras with sensors tuned to multiple light spectrums, Bluetooth, WiFi, a magnetometer, and a processor fast enough to run real-time audio analysis. You’ve been using it to check Instagram.

That’s going to change after this post.

This isn’t about hacking or doing anything illegal. It’s about knowing the full capability of the hardware you’re already carrying so you can use it in situations that matter…hotel rooms that might not be private, conversations you need to document, unfamiliar spaces you’re entering and don’t fully trust. Prepared civilians extend their senses. This is how you do it with what you already own.

Six capabilities. Most people know zero of them.

The first one is built directly into iOS…no app required, no settings buried in a menu most people never open. It turns your iPhone into a remote listening device with one tap from the Control Center. And it leaves nothing visible on the screen when it’s running.

The full breakdown, all six techniques including the IR camera detection trick, the through-door audio method, and how to scan a hotel room’s network for unauthorized cameras, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

The thing that gives you away isn’t your gear…it’s your face.

When someone who knows what they’re looking for is scanning a room, they’re often not looking for tactical vests or gun bulges.

They’re looking for people who are watching the same things they are.

The systematic eye movement. The slight muscle tension around the jaw. The deliberate positioning near exits.

The way someone sits with their back to a wall and then immediately checks every person who walks through the door.

Prepared civilians do all of this. They think it’s making them safer.

In a specific, measurable way, it’s also making them visible…to the exact category of threat they’re most worried about.

In intelligence and protective work, there’s a concept called “going gray.”

We’ve all heard of it. We’ve all mocked it. Yada, yada, yada…

However, there are some lessons to be learned.

The idea is simple: a person operating in a denied environment has a better chance of surviving if no one identifies them as a person worth watching.

Not invisible…just unremarkable.

The face no one remembers. The person who fit perfectly into the background.

The challenge isn’t dressing for it.

Most people, when they hear “gray man,” think: don’t wear tactical gear in public.

That part is real, but it’s the easy part.

The harder part is behavioral.

What you wear accounts for maybe 20 percent of how observable you are.

The other 80 percent is what your body does when your brain is on high alert.

When your threat recognition system activates, your body responds in ways you can’t fully control: elevated muscle tension in the jaw and shoulders, slight dryness in the mouth, a measurable increase in scanning speed when your eyes move through a space.

None of this is dramatic, but it’s readable to anyone who knows the pattern.

And the people most likely to be scanning for these signals are the people you’d most want to avoid drawing attention from.

There’s a second problem. Going gray isn’t a static state.

It requires constant calibration to the specific environment you’re in…what the baseline behavior looks like, who belongs, and how belonging is expressed.

Fail that calibration, and you’re visible regardless of what you’re wearing.

The full breakdown, including the three behavioral signals that make alert people visible and the specific calibration framework for going gray in real environments, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

You probably saw the photo. Tailored suit, Crye Precision backpack, expressionless face.

In his hands: an HK MP7 personal defense weapon, Aimpoint T2 on a Unity FAST mount, SureFire XVL2-IRC forward, collapsible foregrip.

The agent deployed it during the April 25 breach attempt at the White House Correspondents’ Dinner after Cole Thomas Allen showed up to the Washington Hilton with a shotgun, a pistol, and knives.

The internet lost its mind, and I get it. That is a genuinely impressive piece of kit, deployed by someone who looked like he knew what he was doing.

But the part that most of the gear conversation missed is more interesting than the MP7 itself.

The question worth asking is not “what is that gun” but “why does that category of gun exist at all, and what does the answer mean for you.”

The MP7 belongs to a weapon category called the Personal Defense Weapon, or PDW. The category was “invented” to solve a military problem that nobody had a good answer to.

In the early 1990s, NATO identified a gap in their force protection. Rear-echelon troops, logistics personnel, vehicle crews, artillery teams, support staff, were issued pistols.

Pistols are better than nothing. They are not much better than nothing against a threat wearing body armor.

A rifle solves the armor problem, but is impractical for troops whose primary job is not shooting: it is bulky, it gets in the way, and most of these personnel are not rifle-trained to a level where the added length and weight actually translates to capability.

NATO’s answer was to define a new requirement: a weapon small enough to carry like a pistol, firing a round specifically engineered to defeat soft body armor at ranges out to 200 meters.

The result was the PDW category, and HK built the MP7 while FN built the P90. Both chambered proprietary high-velocity, steel-core cartridges designed for exactly this purpose.

The MP7’s 4.6x30mm round was engineered from the ground up to punch through NIJ Level IIIA soft armor, the same standard that covers most concealable vests, while keeping recoil and platform size manageable.

The gun collapsed is about 16.5 inches. Loaded, it weighs under five pounds. Rate of fire is around 950 rounds per minute. The round moves fast enough to defeat armor that a 9mm cannot reliably beat.

That is why the agent at the Correspondents’ Dinner was carrying a tool built specifically for a scenario where a pistol may not be enough, and a rifle is not appropriate.

Now let’s talk about the gear on that specific gun, because it is worth understanding why each piece is there.

Aimpoint Micro T2 on a Unity Tactical FAST mount.

The T2 is one of the most trusted red dots on the market for serious use. Battery life is measured in years at normal usage. The lens coating is excellent in low light.

The Unity FAST mount raises the optic high enough that you can get a natural cheek weld on a folded-stock PDW or SBR without craning your neck. That matters when you are deploying a compact platform from a non-standard position under stress.

SureFire XVL2-IRC.

This is a combined white light and infrared laser module. The white light handles positive target identification in low-light environments.

The IR component is for use with night vision, which plainclothes federal protection details carry more often than most people assume.

Running IR in a hotel ballroom seems like overkill until you realize these agents work across wildly different environments, and a single configured weapon beats carrying multiple setups.

The Crye Precision backpack.

This is the piece most people glossed over in favor of the gun. Crye Precision builds gear for people with specific operational requirements and the budget to solve them.

The EXP-series pack has an internal configuration that allows a compact long gun to be staged vertically for a rapid one-handed draw. The exterior looks like a professional’s commuter bag. That is intentional, and concealment is the point.

This setup, from the optic mount height to the IR capability to the carry container, tells you this agent is not improvising. Every component answers a question somebody asked before the event happened.

The Civilian PDW Problem

Here is the honest answer most gear content will not give you: civilians in the United States cannot buy an MP7. The platform is not available on the civilian market. The 4.6x30mm round is not something you can stock at a standard dealer.

What civilians can do is apply the thinking behind the PDW to what they actually have access to.

The PDW concept is not about any specific platform. It is about identifying the capability gap in your defensive setup and finding the right tool to fill it.

For a NATO rear-echelon soldier, the gap was “my pistol won’t stop an armored attacker.” For you, the gap is probably different.

Most civilian defensive setups look like one of three things: a carry pistol, a home defense shotgun or rifle, or nothing.

The gap is usually in the middle. A carry pistol maxes out around 15-17 rounds and is accurate to maybe 25 yards/meters in the hands of an average shooter under stress (I know…results may vary). A rifle or shotgun is not something you can easily always have on your person in a public space.

What fills that gap for a civilian is worth thinking through seriously.

At home

The pistol-caliber carbine is the civilian equivalent of PDW thinking. Platforms like the CZ Scorpion, SIG MPX, B&T APC9, or even a good MP5 clone give you rifle-like ergonomics and accuracy, magazine capacities that substantially exceed a handgun, and calibers that run reliably in a short barrel without the overpressure problems you get with rifle cartridges.

They are maneuverable in hallways. They are easier to shoot accurately under stress than a pistol. They share magazines with your carry gun if you run the same caliber.

For home defense, this is the closest civilian analog to what that agent was carrying.

In a vehicle

The PDW concept for vehicle carry in a civilian context is a compact pistol configured for serious use.

That means a quality red dot, the Holosun 507C or SIG Romeo2 are solid (cheaper) options, a weapon light in the 1,000 lumen or above range, and a consistent carry position where you can access it with your support hand if your primary hand is occupied.

Vehicles are confined spaces with limited movement options. Accuracy at speed matters more than it does in a static shooting position.

On your person

This is where the PDW concept most directly challenges civilian EDC thinking. You cannot carry more gun than your environment allows. But you can carry your existing gun better.

A compact pistol with a red dot and a weapon light is meaningfully more capable than the same pistol without either, at the engagement distances and lighting conditions where defensive shootings actually happen.

Adding a spare magazine(s) addresses the capacity gap that separates pistols from PDW platforms. These are not exotic purchases; they are the civilian equivalent of doing a similar analysis that the agent’s unit did before that event.

What to Do

1. Map the gap in your own setup. Write down what you carry, where you are when you carry it, and what scenarios your current gear cannot handle. That gap is what you need to solve. Do not buy more gear before you know what you are buying it for.

2. If you do not have a weapon light on your carry gun, fix that first. Positive target identification in low light is not optional. The SureFire XVL2-IRC on that MP7 costs a bit of your paycheck. A SureFire X300 Ultra or Streamlight TLR-1 HL on your carry pistol costs significantly less and closes the single most common capability gap in civilian defensive carry.

3. Consider a red dot if your pistol will accept one. The Aimpoint T2 on the MP7 exists because a red dot improves speed and accuracy, especially under stress. The same is true on a pistol. It takes training to run well. That is the point.

4. For home defense, evaluate whether a PCC closes gaps your pistol does not. If you are running a full-size pistol for home defense, a pistol-caliber carbine in the same caliber gives you a meaningful accuracy and capacity upgrade with manageable concessions. It is not the right answer for everyone, but it is worth the analysis. Let’s not forget about those SBR’s….

5. Train to access, not just to shoot. The agent’s Crye backpack is only useful because he has practiced drawing from it. Whatever your carry setup is, practice the draw from the position you actually carry in, under conditions that approximate the stress you might face. Speed of access is a capability multiplier.

The Edge

The NIJ Level IIIA point is worth sitting with for a moment.

The MP7’s round was specifically engineered to defeat soft body armor at the threat level that is commercially available and increasingly common in mass casualty events. That is the reason the platform exists.

Most defensive ammunition for 9mm and .45 ACP is optimized to expand in soft tissue. It was not designed with armor in mind because that was not the assumed threat. Armor-piercing pistol ammunition is illegal for civilian ownership under the Law Enforcement Officers Protection Act.

This is not a reason to panic. It is a reason to understand what your ammunition is and is not capable of, and to recognize that the professionals who built the MP7 were solving a problem that did not exist in civilian contexts a decade ago and is not yet common now.

The threat environment changes. The gear follows. The best time to understand that sequence is before it matters.

The official line was that the threat being raised was “not solely” because of Golders Green. That phrasing is worth sitting with.

When an intelligence agency publicly raises its threat level to SEVERE and immediately clarifies that a terrorist stabbing of two Jewish men wasn’t the main reason, that tells you something.

It means the picture they’re not fully describing is worse than the one they’re willing to describe.

The Joint Terrorism Analysis Centre raised the UK threat level from SUBSTANTIAL to SEVERE on April 30, 2026. SEVERE means a terrorist attack is “highly likely.”

CRITICAL, the level above it, means one is “expected imminently.” The UK hasn’t been at SEVERE since November 2021. That time, it took two separate attacks to get there.

The visible trigger was the Golders Green attack on April 29. Essa Suleiman, a 45-year-old Somali-born British national, stabbed two Jewish men on Highfield Avenue in north London.

Shloime Rand, 34, and Moshe Shine, 76, both suffered serious injuries. Suleiman also attacked a third man earlier that same day.

He was Tasered at the scene, charged with two counts of attempted murder and possession of a bladed article, and remanded in custody. The Metropolitan Police declared it a terrorist incident.

That’s the incident the coverage led with. But JTAC’s language pointed somewhere broader.

Officials cited a “gradual rise in threats over time,” driven by increased volume, breadth, and complexity across multiple ideologies.

That’s counter-terrorism language for: more cases, more planning activity, and different kinds of people doing it.

The specific threat environment includes rising Islamist terrorism (still the primary threat), a documented increase in Extreme Right-Wing Terrorism from individuals and small groups, and an elevated threat to Jewish and Israeli targets tied to the ongoing Middle East conflict.

Three separate threat streams, all trending up simultaneously.

JTAC doesn’t raise to SEVERE because of one incident. They raise to SEVERE because they’ve been watching a threat picture build for months and decided the gap between what’s assessed privately and what’s communicated publicly had become untenable.

The 2021 comparison is the most useful data point, but most coverage ignored.

The last time the UK hit SEVERE was November 2021. It took two separate incidents to get there: the Liverpool Women’s Hospital car bombing on Remembrance Day, and the murder of MP Sir David Amess, stabbed in his constituency surgery.

Two unrelated attacks within weeks of each other, different ideological backgrounds. JTAC raised to SEVERE and dropped back to SUBSTANTIAL in February 2022, roughly three months later.

The difference now: officials are not framing this as a reaction to a specific attack. They’re describing a sustained build.

The Golders Green attack gave them a public reference point, but the intelligence basis for the raise was already there.

That distinction matters. In 2021, the raise was responsive. Two attacks happened, the threat level reflected the post-incident environment.

In 2026, the raise is anticipatory.

The cases, planning activity, and radicalization pipeline had already justified a higher designation before the attack occurred. The attack gave JTAC a moment to communicate it publicly, but didn’t create the justification.

Anticipatory raises are harder to walk back. JTAC doesn’t lower the level until the intelligence picture clears.

The factors they cited, volume, breadth, complexity, multiple ideologies, don’t resolve quickly.

The targeting pattern is the other element mainstream coverage is underweighting.

Three of the threat streams JTAC identified are converging on the same target set: Jewish and Israeli individuals and institutions.

Islamist-motivated actors, ERWT actors, and state-linked threat activity are all producing elevated threat to Jewish communities, though for different reasons.

Islamist actors tied to Gaza-related radicalization. ERWT actors operating on longstanding antisemitic ideology. State-linked activity tied to Iranian intelligence targeting Israeli diaspora.

Golders Green was one of London’s most visibly Jewish neighborhoods. The arsons on Jewish-linked premises that preceded the stabbing were part of the same targeting pattern, multiple prior arrests, and a sustained campaign against Jewish institutions that has been escalating toward direct violence.

For anyone operating near these communities, that concentration of threat from multiple unrelated threat actors on the same physical spaces is an operational risk factor that doesn’t appear in generic threat level guidance.

The official “be alert but not alarmed” messaging is designed for the general public. It’s not designed for people trying to make actual risk decisions.

What to Do

1. If you’re traveling to the UK in the next 60 to 90 days, raise your baseline awareness posture, not your alarm level. SEVERE changes the probability calculus of a bad event, not the behavior you’d use to respond to one. Know your exits. Reduce time in transitional spaces. Pay attention to anything drawing police attention before deciding whether to stay or move.

2. If you work with or support Jewish community organizations, institutions, or events, treat the UK targeting pattern as a leading indicator. The same converging threat streams, Islamist radicalization, ERWT, and state-linked intelligence activity, are active in multiple Western countries. UK threat levels often surface formally a few months before the same patterns show up elsewhere.

3. Pay attention to soft targets adjacent to Jewish and Israeli-linked venues. The pattern in the UK has been primary targets absorbing security upgrades while the attacks happen on the streets around them. Highfield Avenue is a residential street, not a secured facility. The hardening of the obvious target pushes the violence one step outward.

4. Separate the SEVERE designation from the Golders Green media cycle. The news coverage will move on. The JTAC assessment is based on an intelligence picture that hasn’t changed. Check MI5.gov.uk for updates, not news headlines.

5. If you’re building or advising security programs for Jewish community organizations in the US, this threat environment is a documented, official, sourced reference point for current risk conversations with leadership. The UK data is real and applicable to that conversation right now.

The Edge

The Golders Green reporting largely skipped over one detail: Suleiman attacked a third man earlier the same day, at a different location. That matters.

He was already in an active threat state before the primary attack. His violence didn’t suddenly escalate from zero…it had already started.

The pre-attack indicators existed but played out on a different victim, in a different location, before law enforcement could connect the sequence.

That’s a pattern with implications beyond this specific case.

When a threat actor is already in motion, the first event in the sequence often doesn’t present as terrorism. It looks like a street assault.

The information processing gap between “street crime” and “active terrorist” is real, and it costs response time.

If you’re in a high-threat environment and you hear about a nearby assault before any larger incident, that’s a data point, not background noise.

The tornado is gone before you can fully process what happened. Ninety seconds, maybe less. Then it goes quiet in a way that doesn’t feel right.

You’re in the closet, or the bathroom, or wherever you went. You’re okay. Now you open the door.

What comes next is where most tornado injuries actually happen. Not the tornado itself. The aftermath. You’re in the dark. There’s drywall dust and insulation in the air. You smell something you can’t quite place. The hallway looks wrong.

Whether you handle the next 60 minutes well or badly comes down to one thing: what’s in that shelter space with you right now.

The kit stored anywhere else is useless.

Most people who have a tornado kit keep it in the garage, a utility room, or stacked in a hall closet.

That works for a drill. In a real event, the space between your shelter and that kit may be blocked by debris, collapsed walls, or exposed structure.

You may not be able to get there. You definitely can’t get there safely if the building took a direct hit.

Everything below goes in the shelter space. Not near it. In it. If it doesn’t fit, prioritize until it does.

One more thing before the kit: know the difference between a watch and a warning.

A tornado watch means conditions are favorable and a tornado is possible.

A tornado warning means one is confirmed on the ground or radar-indicated.

When a warning is issued for your location, you have minutes at most. You go to the shelter, you close the door, and the kit is already there.

What goes in the kit, and why

Break it into three groups: immediate survival, protection, and the hours after.

Immediate Survival (First 60 Minutes)

Hand crank weather radio

Our phone may work after a storm. It may not, cell towers take damage. Even if service holds, the battery won’t.

A hand-crank radio gives you NOAA broadcasts, weather updates, and emergency alerts without needing power or a charged device. This is the one item you should not cut.

Flashlight with extra batteries and a headlamp

You want your hands free when you’re moving through debris. Use the headlamp for work, the flashlight as backup. Both go in the kit with batteries already installed.

First aid - real first aid

Drugstore kits handle splinters. They are not built for trauma. If you’re moving through debris with exposed structural material, lacerations and puncture wounds are realistic outcomes. Add QuikClot or hemostatic gauze, a tourniquet, and wound closure strips. Take a Stop the Bleed course before you need to use any of it.

Whistle

If the structure collapses around you and you can’t move, a whistle carries farther than a voice and requires almost no energy. Put one in the kit. Put another on a keychain for each person in the household.

Protection

N-95 masks for every person

Tornadoes pull everything into the air: insulation, mold, asbestos from older structures, and chemicals from garages and storage areas. The air after a structural event is not clean. Put a mask on before you start moving.

Heavy leather gloves

Roofing nails, broken glass, splintered framing, and moving debris with bare hands are how a survivable event becomes a serious injury. Gloves go in the shelter kit, not in the garage.

Fire extinguisher

Gas lines break. Electrical shorts happen. A fire starting inside a compromised structure spreads fast because the walls are already open. Keep a small extinguisher in the shelter space and know how to use it.

Gas shutoff wrench or channel lock pliers

If you smell gas after the storm, you need to shut it off at the meter. You need a tool to do that. If your usual tool was in the garage and the garage is gone, you don’t have a tool. Dedicate a pair to the kit.

Clothes and shoes for everyone

This one gets skipped constantly. If you shelter in pajamas and your bedroom is destroyed, you’re going to walk through broken glass and debris in socks. Pack a sturdy pair of closed-toe shoes and a basic set of clothes for each person.

The Hours After

Water, one gallon per person in small consumer-size bottles.

Municipal water is often contaminated or offline after a major event. Small bottles fit better in a confined shelter space and are easier to ration.

Snacks, one day per person

You’re not building a long-term cache. You’re building for the period between the storm and when you can assess and move. One day of calories per person is the right scope.

Emergency blankets

If the structure is open to the sky, temperature becomes a problem faster than most people expect. Mylar blankets pack flat and provide real warmth.

Ponchos or contractor trash bags

Waterproofing matters for rain exposure after the storm and for keeping debris out of open wounds while you move.

Hand sanitizer and toilet paper

Post-disaster sanitation gets overlooked. Sewage infrastructure often takes damage in tornado events. Plan for it now.

Cash

If regional power is out, ATMs and card readers are down. Cash gets you gas, food, and lodging.

Local maps

Cell service and GPS are unreliable in major storm events. A paper map of your county is cheap insurance.

Extra car key and house key

If your primary set is buried in debris, you need a backup.

Special supplies

Medications, diapers, hearing aid batteries, mobility aids…whatever your household needs in the first 24 hours belongs in this kit.

Pet supplies

Food, water, a bowl, and a leash. A stressed dog loose in a debris field is a problem you don’t need. Address it before the storm.

Before You Call This Done

The kit assembled and never practiced is a box full of guesswork. Run the scenario once with your household. Everyone goes to the shelter space on a normal afternoon. Where does everyone fit? Can you access the kit in the dark? Does everyone know what the whistle is for?

Also, keep a NOAA Weather Radio in your primary living area, not just the shelter space. The shelter kit handles what comes after. The radio handles the warning that gets you there in time.

What to Do

1. Identify your shelter space today. Small, windowless, interior room on the lowest floor. Decide now.

2. Move the kit into that space today. If it doesn’t fit, start with the priorities: water, first aid, flashlight, radio, masks, gloves, shoes, cash.

3. Add a tourniquet and hemostatic gauze to your first aid kit. Take a Stop the Bleed course before you need them.

4. Put a whistle in the shelter kit and one on each person’s keychain or bag.

5. Run a shelter drill with your household before storm season. Know where everyone goes and in what order.

One more thing

The item most people skip is the shoes.

After talking with people who have been through tornado events, one pattern consistently comes up: the injuries that happened during recovery, not during the storm itself.

People walking through debris fields to check on neighbors, find pets, or reach their cars…in socks, sandals, or bare feet. The tornado lasts 90 seconds. The debris field is hours. Pack the shoes.

The decision to target a home doesn’t start on your street…it starts at a keyboard.

Before a burglar, stalker, or bad actor ever puts eyes on your physical address, there’s a good chance they already know what your front door looks like, whether your fence has a gate latch on the inside or outside, where your vehicles are typically parked, and whether there’s camera coverage on your entry points.

They know this because you showed them. Not intentionally…but the information is out there, it’s free, and it takes about four minutes to access.

Google Street View is the most visible piece of this, but it’s not the only one.

Understanding the full picture of what someone can learn about your home from a computer is the first step toward doing something about it.

The full breakdown…including who is actually using these tools and why, what Street View blurring actually does (and doesn't) accomplish, and five specific actions to reduce your home's open-source exposure…is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

There are two ways to lose the ability to fight. One is injury.

The other is a slow, comfortable, decade-long process that most people never see coming because nothing ever hurt badly enough to make it obvious.

Roosevelt wrote about this at the civilizational level. He named it: materialism, luxury, safety, sentimentality.

Each one removing a demand. Each removed demand allowing a capability to atrophy.

Until there’s nothing left to draw on when something outside the system requires it.

His warning was about empires. But the mechanism he described works exactly the same way at the individual level, one comfortable decision at a time, and the outcome is the same: a person who was once capable becomes a person who is not.

Most prepared civilians don’t think about this. They inventory gear. They run scenarios. They have a plan.

What the Roosevelt observation suggests is that all of it is secondary to a question most people don’t ask: Are you still capable of executing when the plan is gone, and conditions are bad?

Roosevelt wasn’t writing philosophy…he was documenting a pattern he’d watched repeat across history.

Every civilization that fell to a harder people had first lost something internal, something the historians often record as culture or morale, but is really simpler than that: the willingness and ability to endure difficulty and fight through it.

The process is gradual. It’s almost invisible because it feels like progress.

Comfort is better than discomfort. Safety is better than danger. Convenience is better than friction.

All of that is true under normal conditions. The problem is that preparedness is, by definition, preparation for conditions that are not normal.

The person you are inside a functioning system is not the same person who shows up when the system fails.

The gap between those two versions of yourself is what I’m calling the Softness Gradient. Not softness as a character flaw.

Softness as a measurable loss of capability across specific domains, accumulated quietly through the removal of the conditions that would have maintained it.

The gradient is not binary. You’re not either hard or soft. You’re somewhere on a slope that you’re either sliding down or actively climbing. Most people are sliding without knowing it.

Here’s what the gradient looks like, domain by domain, and how to locate yourself on it.

The full breakdown, including the five specific domains where capability degrades, how to diagnose where you are on each one, and the practical steps to reverse course, is available to paid subscribers. Join Prepared Brief to read the rest.

Read more

ISIS just dropped its official newsletter ordering supporters to set fire to churches and synagogues across the US, Europe, Russia, India, and beyond…timed for Easter Sunday (April 5).

This isn’t vague online ranting. It’s in Al-Naba Issue 541…ISIS’s flagship propaganda outlet that serves as doctrine and tactical guidance for its global network of lone actors and affiliates.

The message is clear: Use the “Sydney Heroes” as your model…the December 2025 ISIS-inspired attack on a Hanukkah gathering at Bondi Beach that killed 15 and wounded dozens. Swap guns for accelerant and a lighter, and the template still works: soft target, public gathering, holiday timing, maximum psychological impact.

Why Arson?

It’s the ultimate low-barrier attack. No guns, no bombs, no network needed. Just gasoline from any gas station and basic household items. ISIS knows most of its Western sympathizers can’t build IEDs or get firearms without raising flags…but they can all start a fire.

What the Newsletter Actually Says

“In the face of the tragedy of the closure of the blessed Al-Aqsa Mosque, it is incumbent upon Muslims everywhere to rise up and set fire to the Jewish synagogues scattered across America, Europe, Russia, India, and elsewhere.” It also names sites in the UAE, Syria, Tunisia, and Morocco.

They’re exploiting real tensions around the Al-Aqsa closure (tied to the Iran conflict), while conveniently ignoring that Iranian missile debris has also endangered the same holy sites.

The Real Threat Level

No specific plots confirmed yet…but none were confirmed before Sydney either. This call is now circulating. Every successful low-tech attack gets added to ISIS’s propaganda library and becomes the next template.

What Prepared Citizens Do This Weekend

Easter services are tomorrow. Take these steps today…they take less than an hour:

1. Scout Exits Immediately: When you arrive, identify two ways out that don’t rely on the main entrance. Do it in the first two minutes.

2. Watch the Perimeter: Someone hanging around outside who never comes in is an anomaly on a holiday. Report it.

3. Harden the Exterior Now: Move trash bins, mulch, and anything flammable away from walls and doors. Arson almost always starts outside.

4. Talk to Leadership & Law Enforcement: If you’re involved with your church or synagogue, confirm they’ve received the threat intel and requested extra patrols.

5. Have a Family Plan: Agree in advance…if something happens near the entrance, which direction do we move, and where do we meet?

This is classic ISIS “inspire” strategy: low-cost, high-visibility attacks that rely on individuals who’ve never met an ISIS member. The newsletter is the weapon.

Stay safe. Be dangerous. Don’t let manufactured outrage turn your place of worship into the next headline.

This brief is free. For deeper threat mapping, gear lists, and member-only updates on rising domestic risks, upgrade to paid at preparedbrief.com.

Most people still think foreign espionage happens in movies or faraway embassies. Elsa Johnson’s testimony before the House Committee on Education & the Workforce on March 26, 2026, proves it’s happening in broad daylight on American college campuses…and the targets aren’t always spies or professors. Sometimes they’re undergrads doing basic research.

Johnson, a junior majoring in East Asian Studies and Editor-in-Chief of the conservative-leaning Stanford Review, detailed a multi-year campaign that began in summer 2024.

A man calling himself “Charles Chen”, complete with fake Stanford photos and 100+ mutual followers, slid into her Instagram DMs days after she discussed Chinese recruitment tactics with a Hoover Institution supervisor.

He offered a fully paid trip to China, promises of wealth and fame, and pushed hard to move the conversation to WeChat (where the CCP can monitor everything).

When she took screenshots, he publicly commented in Mandarin on one of her posts demanding she delete them. That kind of real-time knowledge of private chats is not normal stalker behavior.

The FBI later told her directly: “Charles Chen” had no Stanford affiliation. He (or his network) had been using similar fabricated profiles for years to target female students researching sensitive China-related topics.

She was reportedly one of at least 11 victims since 2020. They assessed he was likely working on behalf of China’s Ministry of State Security (MSS).

After Johnson published investigative pieces on Chinese academic espionage at Stanford, first in the Stanford Review, then a first-person account in The Times, the pressure escalated:

• Intimidating phone calls (some switching to Mandarin) that referenced her mother by name

• Emails demanding she delete published reporting

• FBI notification that she was being physically monitored on campus

• Surveillance extended to her family back home

As recently as the week before her congressional testimony, another suspected CCP-linked call came in.

Johnson didn’t mince words: “I fear for my safety and for my family’s safety. The intimidation calls have not stopped.”

Why This Matters for Civilian Preparedness

Read more

Just before 1 a.m. Thursday, two men walked to the back of a mansion in Porter Ranch and smashed through a sliding glass door.

They were on camera the moment they did it. They knew they were on camera. They didn’t care, because they had already planned the next step.

They pulled out a Wi-Fi jammer, activated it, and the home’s security system went dark.

The cameras stopped transmitting. The wireless alarm sensors dropped offline. And two men were standing at a broken rear door on a property that had just been blinded from the outside.

The home belongs to influencer Raven Tracy McEachin, where she lives with Christian “King” Combs. Neither was home at the time. An employee inside the house heard the glass break, recognized it for what it was, and called LAPD.

Neighbors heard it too and initially thought it was a gunshot. Officers arrived, searched the backyard, and took a report. The suspects fled before police got there. No arrests. Nothing stolen.

That is the news version, which is not what you need.

What you need is this: the sliding glass door and the Wi-Fi jammer appearing together in the same entry attempt is a methodology.

LAPD has flagged this combination repeatedly in recent high-end burglary cases across Los Angeles.

These two tactics work together as a sequence, and if your home security setup runs on Wi-Fi, you are vulnerable to the same approach regardless of what neighborhood you live in.

Here is how it works and what to do about it.

Read more

Nine days into the Iran bombing campaign, drones appeared over Barksdale Air Force Base.

Not one drone…waves of them. Twelve to fifteen aircraft per wave, running four hours a day, focused specifically on the flight line where the B-52s sit.

The base issued a shelter-in-place order on March 9. Flight operations halted. Then the order lifted and the drones came back the next day. And the day after that.

The military didn’t say a word publicly for eleven days.

When they did say something, on March 20, Capt. Hunter Rininger confirmed “multiple unauthorized drones” and said they were working with law enforcement. No arrests. No attribution. The FAA deferred all questions to the military.

I want to be clear about what this actually was before we get into it.

The part the coverage buried

A confidential Air Force briefing from March 15 got leaked. Air and Space Forces Magazine and a few others reported on it.

Here’s the detail that should have been the headline everywhere:

The drones were resistant to jamming.

NORTHCOM had deployed its counter-UAS Flyaway Kit to the base. Anduril-built system, includes electronic warfare capability and kinetic interceptors.

This exact kit was used successfully on February 28, the opening day of Operation Epic Fury, to neutralize a drone threat over another strategic installation.

At Barksdale, the jamming didn’t work. Six days of drone activity, electronic countermeasures deployed, and the drones kept flying anyway.

That’s not in most of the coverage.

Here’s why it matters.

Jam-resistant drones aren’t something you build in a garage. This isn’t a modified DJI Phantom with a software tweak.

The anti-jamming capability described in that briefing, combined with non-commercial signal signatures, long-range control links, and custom construction, puts this in the category of state-level or state-supported hardware. Significant engineering. Significant resources.

Operators who knew what countermeasures they were going to face and built for it.

This isn’t the first time this playbook ran

October 31 through November 2, 2025. Kleine Brogel Air Base in northeast Belgium.

Three nights in a row, drones over the facility.

Kleine Brogel stores B61 nuclear bombs under NATO’s nuclear sharing agreement. The Belgian defense minister described what happened in two stages: small drones first, probing the base’s radio frequencies, mapping the electronic signature of the security systems. Then larger drones operating over the facility itself.

Read that again and then look at Barksdale.

Probing runs. Frequency mapping. Multi-day sequential waves. Deliberate maneuvering to avoid having operators direction-found. Swarm saturation of a defended perimeter. The methodology is nearly identical. And nobody publicly connected those two incidents until now. The Kleine Brogel story barely got coverage in U.S. outlets.

Two NATO nuclear sites. Same playbook. Less than five months apart. That’s not a coincidence.

What four hours over a flight line actually gets you

A fly-over gives you a snapshot. A four-hour loiter gives you an operations picture.

Five active days of 12-15 drones over Barksdale’s flight line, focused on where the B-52s are positioned and prepped for missions, gives you enough time to map aircraft parking positions, document maintenance crew shift patterns, watch fuel and munitions loading sequences, track security response times, identify patrol routes, and find sensor blind spots. That’s targeting intelligence.

One more thing on the visible lights. Most serious reconnaissance platforms run dark. There are two reasons you’d operate with lights on over a restricted military installation.

You’re testing how fast security responds so you can map their coverage. Or the lit drones are the visible layer of a two-layer operation, drawing attention up while something quieter and higher runs the real collection.

Either way, it’s deliberate. That’s not how a curious hobbyist operates.

The timing

Barksdale isn’t just a B-52 base. It’s the operational hub for strategic bombers running combat missions under Epic Fury. Aircraft were launching sorties over Iran during the same week someone was mapping the flight line.

That timing has a name. It’s called wartime reconnaissance.

If you want to know what a base looks like when it’s surging, how many aircraft are launching, what the preparation tempo looks like, how crew patterns change under operational load, you watch it during active operations. Not peacetime.

That’s when the information is current and actionable.

Nobody has attributed this publicly. FBI, Louisiana State Police, and federal agencies are all investigating. No responsible party named.

I’m not going to name one either.

What I’ll say is that the anti-jamming capability and the coordination required to run multi-day swarm operations over a defended military installation during active U.S. combat operations narrows the field considerably.

What to do with this

Barksdale has NORTHCOM support, Anduril hardware, 2nd Security Forces Squadron, and the full resources of the U.S. military. Their jamming failed.

Your water treatment plant has a chain-link fence.

That’s not meant to alarm you. It’s meant to orient you to where we actually are on domestic infrastructure defense against small UAS threats.

The gap at Barksdale isn’t an anomaly. It’s a preview of what most critical infrastructure faces with zero dedicated counter-drone capability.

Stop waiting for mainstream coverage to tell you when something significant happens to domestic infrastructure.

The Barksdale incursion ran six days before it was publicly confirmed. Kleine Brogel barely made U.S. news.

Watch what agencies aren’t saying.

The FAA deferred everything to the military. Multiple agencies went quiet simultaneously.

That’s information.

Know what’s near you.

Military installations, power generation, fuel terminals, communications infrastructure. Not because you need to worry about it every day, because proximity to strategic assets changes your risk calculus when the threat environment shifts.

Watch for follow-on incidents.

The leaked briefing expressed high confidence that similar incursions could continue in the near term.

If that assessment is right, and I have no reason to think it isn’t, this story isn’t over.

One last thing.

NORTHCOM Commander Gen. Gregory Guillot testified before Congress around March 17-19. He described what happened at Barksdale as a “small drone incursion.”

Twelve to fifteen drones per wave. Four hours per day. Five active days. Jam-resistant. Over a nuclear bomber base in the middle of a war.

Small.

Someone decided that’s the word the public should use for this.

I’d think carefully about what else is getting the same treatment.

You hear something that doesn’t fit. A crack. A pop. Screaming from a direction you can’t immediately place. People near you start moving fast, but not all in the same direction.

You are standing in the middle of it.

You have heard of Run, Hide, Fight. You know what it means. And right now, with your pulse already climbing, you are standing there trying to figure out which one applies to this exact situation, in this exact space, with partial information and zero confirmation that what you think is happening is actually happening.

That gap…the one between “something is wrong” and “I am moving”...is where most people lose. Not because they’re cowardly. Not because they don’t know the options. Because they’re trying to solve the wrong problem.

Run, Hide, Fight is an options menu. It is not a decision protocol. Nobody ever froze in an active shooting because they forgot that running was an option.

They froze because they couldn’t figure out which door to run to, whether the threat was between them and that door, and whether stopping to hide was smarter than moving.

Those are real decisions with real consequences, and nobody taught them how to make them fast.

The first five minutes of an active threat are not primarily a physical problem. They’re a decision problem.

The person who survives is usually not the most physically capable person in the room. It’s the person who started moving 30 seconds before everyone else.

Here’s how to be that person.

Read more

Cuba's Grid Is Gone.

Here's What 10 Million People Are Learning Right Now…and What It Means for You.

Cuba’s national grid operator announced a complete and permanent failure of the country’s electrical system on March 16, 2026. Not a rolling blackout. Not a controlled outage. A total collapse.

The Turkish powerships that had been keeping the lights on left because the government stopped paying. The oil stopped arriving. The grid stopped running. Ten million people went dark simultaneously.

This is not a storm. There is no “restoration estimate.” There is no utility crew working through the night. The grid is not coming back until Cuba can pay for fuel to run generation equipment it may no longer be able to restart. That could be weeks. It could be longer.

Most prepared Americans have planned for 72 hours of grid-down. Cuba is showing what happens when hour 73 arrives and the power is still off.

Your 72-hour kit is not a grid-down plan. It is a starting point for one.

Read more

On March 12, a man drove a truck loaded with fireworks and gasoline into Temple Israel synagogue in West Bloomfield, Michigan. More than 100 children were inside.

Staff had been trained on exactly this scenario. Security guards shot the attacker dead before he made it through the building.

Children were carried out through windows and reunited with parents at a country club down the road. One security guard was struck by the vehicle. Nobody else died.

Six hours later, at Old Dominion University in Norfolk, Virginia, a 36-year-old man named Mohamed Bailor Jalloh walked into a group of ROTC cadets and their instructor and opened fire.

He killed Lieutenant Colonel Brandon Shah. He critically injured two cadets. Then the cadets killed him with a knife.

Two attacks. One day. Two different states. Two different motivations. Both stopped by people who were present and prepared to act.

The coverage has mostly treated them as separate incidents loosely connected by timing and the broader Iran war atmosphere. That framing misses the more important story.

This post is for paid subscribers. Join Prepared Brief to keep reading.

Read more