The Blockade Has a Business Model

Confidence: HIGH · Iran, Saudi Arabia · Energy, Maritime, Logistics

If your 2027 planning assumes a Middle East ceasefire puts energy and freight costs back where they were, the last two weeks argue otherwise. Iran is turning the disruption into a revenue line, and the routes around it are being closed.

US Central Command spent Thursday and Friday knocking down Iranian state-media claims that a sanctioned tanker and an Iranian containership had broken through the Strait of Hormuz blockade on July 30, and that the Islamic Revolutionary Guard Corps had destroyed three F-35s. Neither happened. CENTCOM describes its enforcement, more than 20 warships and hundreds of aircraft, as "America's steel wall," and its count since enforcement resumed in mid-July runs to 20 commercial vessels redirected, 2 disabled, and 2 boarded. Windward, an independent maritime-tracking firm, corroborated the denials, showing the Iranian containership reversing course at the edge of the blockade zone on July 30.

The more important development is what happened to the route around the strait. Saudi Arabia's answer to Hormuz risk has always been the East-West Pipeline, which carries crude across the country from the oil fields of the Eastern Province, on Saudi Arabia's Persian Gulf coast, to the Red Sea terminal at Yanbu, on the kingdom's west coast north of Jeddah. The pipeline can move roughly 7 million barrels a day, about 5 million of it available for export. Since March, that bypass has carried the load: Red Sea port exports averaged 4.7 million barrels per day from March through June, nearly triple the 1.6 million of a year earlier. Nearly all of that oil then has to pass through the Bab al-Mandeb strait, the narrow gap between Yemen and the Horn of Africa where the Red Sea empties into the Gulf of Aden and the Indian Ocean beyond it. It's the only way out for anything shipped from Yanbu, and Houthi forces in Yemen sit on one side of it.

Over the weekend of July 25, Iran-backed Houthi forces struck Yanbu and the Jizan refinery, a Red Sea facility near Saudi Arabia's border with Yemen; Aramco confirmed the Jizan shutdown two days later. The Houthis framed the strikes as retaliation for Saudi airstrikes in Yemen, their own war and their own stated motive. But look at the target selection. Neil Quilliam of Chatham House described it as "targeting the safety valve rather than the heart of the production system." Nobody tried to destroy Saudi oil production; the strikes closed the one route built to escape the strait. A separate strike hit Aramco's Abqaiq stabilization complex, on the other side of the country near the Persian Gulf coast, Saudi Arabia's largest single facility and the same one a 2019 drone attack knocked offline, spiking oil prices 20 percent in a day. Abqaiq processes roughly 7 million barrels a day at full capacity. Nobody has confirmed damage anywhere near that scale this time, and oil prices haven't moved as if it happened either. Jizan's 400,000-barrel-per-day refinery is down, with a mid-August restart cited by third-party estimates, not yet confirmed by Aramco.

Meanwhile, the strait itself has acquired a price list, of a kind. The Revolutionary Guard has been charging roughly $2 million per vessel for passage without an IRGC attack, and Iran's parliament is moving to formalize the toll as a standing system rather than a wartime improvisation. But paying Iran doesn't clear the other gate. The US Navy enforces its blockade independently, intercepting vessels in the Gulf of Oman on the far side of the strait regardless of what Tehran has already approved. The Rich Starry, a Chinese-owned tanker previously sanctioned for smuggling Iranian oil, loaded cargo and transited the strait in July after apparently squaring things with Iran, then reversed course back toward Iran's coast the next day once the US Navy caught up with it beyond the strait. A separate, not-yet-agreed proposal for a joint Iran-Oman levy of roughly $1 per barrel is what Oxford Economics estimates could generate $6.8 billion a year if it goes forward, comparable to the roughly $4.7 billion Egypt earns annually from the Suez Canal. Nobody has published a reliable estimate of what the IRGC's own toll is actually generating, and Iran has an obvious incentive to inflate the number: a toll that works is a much better story than a toll that doesn't guarantee anything.

None of that revenue math is verifiable from the outside, and Iran has every reason to inflate it. Its Oil Ministry reports hitting 60 percent of the full-year oil-revenue target in the opening months of the Iranian fiscal year, which began in late March: $18 billion in total, $11.5 billion of it earned under active war conditions, with about $11 billion transferred to the treasury. Treat those figures with real skepticism. But the message itself is worth reading: Tehran is telling its own public, and by extension everyone else, that confrontation pays, even while the traffic data suggests the toll is more of a story than a functioning system.

Nobody has to prove Iran ordered the Houthi strikes for the math to hold. The Houthis have their own reasons to hit Saudi Arabia, and there's no evidence of direct Iranian command. What matters is who benefits when the routes close. A cargo that can't use the bypass either sits and waits, pays Iran's toll and still might not get through, or moves at a higher price because less oil is reaching the market. Every one of those outcomes helps whoever has already priced the chaos into its own budget. Whoever gave the order, Iran collects.

The Takeaway: Retire the assumption that a ceasefire resets energy and freight costs to where they were. Iran's toll has its own bill moving through parliament and its own line in Iran's budget now, and a toll with a budget line behaves like a tax, not a crisis. Taxes outlive the emergencies that justified them. Whether you're the CFO reviewing landed-cost and freight assumptions or the one who hands them to one, build in a standing Hormuz toll and a degraded Red Sea bypass as the base case, and treat a real return to pre-war costs as the upside, not the plan.

Sources: The Maritime Executive on CENTCOM's denial of Iran's breakout claims · AGBI analysis of the Yanbu attacks and Saudi export vulnerability · OilPrice.com on the Abqaiq strike and what markets are misreading · Fortune on the emerging Hormuz toll regime · PBS NewsHour on the US blockade operating independently of Iran's toll (the Rich Starry example) · Jerusalem Post on Iran's oil-revenue figures · Ghana Upstream corroborating the Oil Ministry numbers

Moscow Is Writing the Legal Brief Against Starlink

Confidence: MODERATE · Russia, Ukraine · Telecommunications, Technology

Call this what it is: foreshadowing, not analysis. When a government publishes a legal case for striking something it hasn't struck yet, that's usually a sign of what comes next, not academic commentary.

On July 31, Russian state outlet TASS carried claims from Dmitry Kuzyakin, chief designer at Russia's Center for Integrated Unmanned Solutions, that SpaceX knowingly lets Ukraine spoof Starlink terminal coordinates for drone strikes deep into Russia. Ukrainian operators, he claims, physically embed a "digital shunt" into a Starlink dish that feeds the network false location data. His conclusion: because SpaceX allegedly knows about the workaround and does nothing, the satellites themselves are fair game under the laws of war. None of this is independently verified, and TASS is an arm of the Russian state. The claims still matter: this is how a government lays legal groundwork before it acts, not how it explains something after the fact.

Russia is dressing the argument in Western clothing to make it sound less like propaganda. Back in November 2023, at a UK space industry conference in Belfast, US Air Force lawyer Major Jeremy Grunert warned satellite companies directly: stay out of a conflict, or risk becoming a legitimate target in one. He teaches space law at the Air Force Academy, and his point was aimed at industry, a caution about a real legal gray zone, not a US policy statement. Russian state media is now citing that same warning as legal cover for its own case against Starlink, nearly three years later and for the opposite purpose he intended.

None of this suggests Moscow or Tehran actually cares whether a tribunal would agree. The audience isn't a court. It's everyone watching how each side frames the next strike before it happens, so that when it does happen, there's already a story ready to tell. Iran ran the same play in April, when its Revolutionary Guard declared 18 named US companies legitimate military targets. Iranian drones then struck Amazon's AWS data centers in the Gulf. Different actor, different asset class, same sequence: publish the justification, then act. Legal groundwork like this is cheap and reversible, and that's exactly why it comes first.

The Takeaway: A civilian company doesn't get a vote in whether its technology gets pressed into military use, and once that happens, the argument for treating it as a target writes itself. The COO-level question isn't whether you're at risk directly. It's which of your vendors, especially in telecom, cloud, and connectivity, could be pulled into someone else's conflict without your knowledge, and what that would do to your own supply chain or information flow if it happened. Map that dependency before your next vendor-risk review, not after a strike makes the question urgent.

Sources: TASS's 2023 report of the Grunert remarks in Belfast · Pravda Germany's English translation of the TASS/Kuzyakin piece (Russian state-adjacent media, claims unverified) · Original TASS article in Russian

A Recurring AI Dispute Just Became a Government-to-Government Fight

Confidence: MODERATE · United States, China · Technology

Chinese firms distilling capability out of Western frontier models isn't news. It's happened at least three times this year. What's new this time is who is doing the arguing: for the first time, a named US government official made the accusation and opened a formal investigation, and China's government answered with an on-the-record retaliation threat, not researchers and company statements trading claims in the background.

The mechanism itself is well documented by now. Ask a frontier model millions of questions, capture its answers, and use them to train a cheaper imitation: no stolen code, no stolen model weights, just capability transferred through the front door. Anthropic and outside researchers have made versions of this accusation against Chinese firms at least three separate times in 2026, against DeepSeek, Moonshot, MiniMax, and Alibaba's models. A Jamestown Foundation review adds a new piece: Chinese academic papers from 2024 through 2026 show institutions affiliated with the People's Liberation Army, alongside the Chinese Academy of Sciences and state defense-electronics firms, distilling Western models, including Anthropic's Fable 5, for proposed military uses such as facial surveillance, social-media monitoring, and command systems, not just commercial competition.

What actually changed in July is the escalation. White House science and technology policy director Michael Kratsios publicly accused Moonshot AI's Kimi K3, a 2.8-trillion-parameter model, of improperly distilling Fable 5, and Treasury Secretary Bessent has floated sanctions; the Commerce Department's Bureau of Industry and Security opened a formal review. That's a different order of event than a company blog post or a research paper: a named cabinet-level official making the accusation, with an actual investigation behind it. China's Ministry of Commerce responded in kind, accusing the US of "AI hegemony" and vowing "all necessary measures," without saying what those are. A private technology dispute became a government-to-government one, on the record, for the first time.

That matters because Washington already showed, in June, that it will disable a deployed commercial AI model on its own authority, no warning, no published criteria. The Atlantic Council's read: any US developer's flagship model can face unpredictable restriction with minimal warning, absent legislation establishing a clear process. That precedent is what makes the current investigation different from the last three distillation disputes: an actual US trade enforcement action is now plausible, and Beijing has put a specific, if vague, retaliation threat on the record in response. Whatever happens to Kimi K3 specifically, the fight itself, a formal accusation, a formal investigation, a formal retaliation threat, is the new territory.

The Takeaway: Three distillation disputes this year stayed contained to companies and researchers. This one has a named US official, a formal investigation, and an on-the-record Chinese retaliation threat, which makes it the first with real trade-policy teeth. Whether or not Kimi K3 specifically gets restricted, that enforcement path now exists for the next dispute. This is CIO-level work, yours or someone else's: within thirty days, map which products and vendors depend on which specific models, and get in hand whatever migration or continuity commitment the vendor has actually signed, as opposed to implied.

Sources: Jamestown Foundation on Chinese research distilling Western models for military use · Global Times carrying the Ministry of Commerce response on Kimi K3 · Atlantic Council on the Fable 5 shutdown and the precedent it sets

117 Rules for the Same Bad Day

Confidence: HIGH · United States · Public Sector, Critical Infrastructure

The Government Accountability Office counted the cybersecurity regulations sitting on top of American companies: 117 of them, across 37 federal agencies. The finding that deserves board attention is the overlap.

GAO report 26-108606 maps those 117 regulations across 9 critical-infrastructure sectors and finds that 80 of them carry a reporting requirement overlapping with at least one other regulation. In practice, that means one incident, one set of underlying facts, filed separately to multiple regulators on multiple clocks in multiple formats. The overhead is the visible cost: duplicated legal review, duplicated forensic summaries, duplicated hours during the exact week your team has the least to spare.

The quieter risk is inconsistency. When the same event is described three times by three different people under three different deadlines, the versions drift. One filing says "unauthorized access," another says "potential exposure," a third carries a different record count because the forensic picture changed between due dates. Those filings are discoverable, and plaintiffs' counsel and enforcement attorneys read them side by side. A discrepancy you created by complying three times can read, in a courtroom, like a story that changed.

Washington has tried to fix this before and stopped trying. A Cyber Incident Reporting Council put out harmonization recommendations back in 2023; GAO found they were never fully carried out. The interagency forum built to align regulators with each other, the Cybersecurity Forum for Independent and Executive Branch Regulators, hasn't met since late 2024. GAO's own recommendation here isn't a new fix, it's asking the Office of the National Cyber Director to finish what an earlier effort already started and quietly dropped. Meanwhile CISA is finalizing a new rule this fall, expected in September, that adds its own reporting requirement on top of the existing 117 rather than replacing any of them. Financial services firms already report to eight different regulators; after this rule takes effect, that becomes nine. There is no consolidation coming. Plan for 117 to become 118.

The Takeaway: Don't wait for breach counsel to tell you which regulators you need to notify and on what clock. Build that notification map before an incident, not during one: which regulations apply to your sector, each one's deadline and definition of a reportable event, and who signs each filing. Because the facts of an incident evolve as an investigation unfolds, have the actual paperwork drafted by legal counsel who understands the underlying technology well enough to keep the filings consistent as the picture changes, and that may not be your inside counsel.

Sources: GAO-26-108606, the full duplication report · Mondaq on GAO's findings and the stalled harmonization forum · Federal News Network on the CIRCIA final rule timeline

The Tariff Survived. The Law Under It Didn't.

Confidence: HIGH · United States, Brazil, Global · Manufacturing, Logistics

Two weeks ago we told you Section 122 tariff authority was set to expire and Section 301 was queued up to take its place. Both happened on schedule, July 24, and the response from trading partners arrived almost as fast: Brazil is now suing the US at the WTO, and South Africa hit back with a tariff of its own within hours of the deadline.

The numbers are now final: 60 economies, 99.4 percent of US imports, duties of 10 to 12.5 percent. Section 122 expired the same day it was replaced, after the Court of International Trade had already ruled it unlawful in May; that injunction is now stayed and on appeal at the Federal Circuit. Section 122 had itself stepped in after the Supreme Court struck down the administration's original tariff authority under the emergency-powers law IEEPA back in February, making Section 301 the third legal foundation for the same policy goal in 18 months. Brazil filed a formal WTO dispute July 27 against two of the Section 301 actions, a 25 percent tariff plus a 12.5 percent forced-labor enforcement tariff that stack to roughly 40 percent combined duties on some products, covering about $6.6 billion in Brazilian exports. South Africa's revenue service imposed a new 20 percent tariff on rock-drill parts, up from zero, across all five Southern African Customs Union members, aimed principally at Chinese and US exporters.

The Takeaway: Stress-testing the published tariff rate table isn't enough. Test the legal foundation underneath it too: this is the third authority in 18 months, and each replacement has moved exclusions, stacking rules, and refund exposure along with the rate. Retaliation is no longer a tail risk either. Two countries hit back within days of the latest change taking effect. Build both into the next quarterly trade-compliance review: which authority this tariff is standing on, and who is likely to retaliate if it changes again.

Sources: WTO official notice of Brazil's dispute request (WT/DS646/1) · Peacock Tariff Consulting on the new Section 301 regime · Peacock on Brazil's WTO dispute · Engineering News on South Africa's rock-drill tariff increase

The Modem Nobody Put on the Asset List

Confidence: MODERATE · United States, Iran · Critical Infrastructure, Public Sector

Water pressure dropped and some plants flooded in Minnesota last week, when a coordinated attack cut operators off from the equipment that runs their own treatment systems. US investigators think Iran is probably behind it.

CISA (the federal Cybersecurity and Infrastructure Security Agency), the FBI, and the EPA responded after the attack hit operational-technology systems at more than 30 water utilities across Minnesota on July 26-27, four communities, Braham, Plymouth, South St. Paul, and Maple Plain, have publicly confirmed it, with at least 9 more systems hit in Michigan and federal officials confirming activity in seven states total. Attackers got in through internet-exposed programmable logic controllers, the industrial computers that run pumps and valves, some of which were still running factory-default passwords. Once inside, they changed those passwords and reassigned the controllers' IP addresses themselves, so operators could no longer log in or reach the equipment on the network they knew. The loss of monitoring and control caused pressure loss and flooding at some facilities; drinking water quality itself wasn't affected, and none of the four named Minnesota utilities needed a boil-water notice, because operators who had rehearsed manual-operation procedures were able to keep the systems running by hand once the network access was cut off.

US investigators have preliminarily linked the intrusion to Iran, specifically the IRGC-affiliated group tracked as CyberAv3ngers, and Minnesota's state fusion center says the pattern matches a campaign CISA has tracked since April under advisory AA26-097A. Attribution isn't confirmed, and officials haven't ruled out a false flag designed to look like Iran. Either way, the campaign itself has escalated. CISA's advisory was updated in July to add Schneider Electric and Siemens equipment alongside the Rockwell devices already named. It also documented something new: attackers copying the PLC project files, the actual files containing the programming logic that tells the equipment how to run, off victim networks and onto systems the attackers controlled. That's a step beyond locking an operator out of a control panel. It means the attackers now hold a working copy of exactly how a specific utility's pumps and valves are programmed to behave.

The access point matters more than the attribution. CISA is pointing at undocumented cellular modems: hardware installed years ago by an operator, a vendor, or a systems integrator for one-off remote support, then forgotten. WaterISAC, the water sector's own threat-sharing organization, flagged this exact vulnerability in guidance back in December 2024, twenty months before this attack. It still wasn't closed. A modem like that never shows up in an attack-surface scan, because the scan only covers the network you know you have, and the same convenience-install pattern exists in manufacturing plants, warehouses, and building-management systems, not just utilities.

The Takeaway: Get a physical inventory this week, from your facilities lead or done yourself if that's your seat, of every cellular modem attached to operational equipment: walk the floor, follow the antennas, match each device to a contract and an owner. The water sector had twenty months of warning about exactly this gap and it still wasn't closed in time; assume your own inventory has a version of the same blind spot until you've checked.

Sources: CISA advisory on activity targeting water-sector PLCs · Washington Post on the Michigan systems and the FBI investigation · CBS News on the Iran attribution investigation · Tenable on CISA Advisory AA26-097A and the July update

The Liability Doesn't Stay With Whoever Got Hacked

Confidence: HIGH · United States · Healthcare, Pharmaceuticals, Financial Services

Amgen, the world's largest biotechnology company by revenue, disclosed in July that attackers stole patient health data and business data from a cloud system run by an outside vendor. Amgen hasn't named that vendor. It doesn't yet know how many patients are affected, or how the attackers got in. What it does know is that it's now running two separate regulatory deadlines, and neither one waits for the other.

The first deadline comes from the SEC. Once a company decides a cyber incident is material, it has four business days to file an 8-K. Amgen made that call on July 29. The second deadline comes from HIPAA. Once a company discovers a breach of patient health data, it has 60 days to notify the patients and the federal government, whether or not the SEC materiality question has been settled yet. If more than 500 patients are affected, HIPAA adds a third requirement: notify the news media in the areas where those patients live. Two different clocks, two different starting points, two different audiences. Missing either one is its own separate violation.

Here's the part that should worry Amgen no matter who its vendor turns out to be. When a vendor's software gets breached, courts are increasingly letting both the vendor and the client get sued, and the vendor's contract rarely covers what it actually costs. In 2025, two zero-day flaws in file-transfer software from a vendor called Cleo Communications let the Cl0p ransomware group steal customer data belonging to Cleo's client, the car rental company Hertz: names, driver's license numbers, and for some customers, Social Security numbers and passport information. A federal class action filed in Illinois named both Cleo and Hertz as defendants, and several more followed in Illinois and Florida. Vendor contracts typically cap the vendor's own liability at a small, fixed number, often a year's worth of fees. A real breach routinely costs far more than that in fines, notifications, and legal defense. The client absorbs the difference, because breach notification law holds the company that touched the customer's data responsible, not whichever party's server actually failed.

The disclosure burden is just as lopsided. Cleo is privately held, so it had no SEC obligation to say anything publicly when its software was breached; the lawsuit is what put its name on the record, not a securities filing. Hertz, as a public company, had no such shelter. Most of the cloud and SaaS vendors your business depends on are private too, which means the vendor that causes a breach often carries no public-disclosure requirement at all. Only the client does.

Litigation moves fast once a breach becomes public. River Financial, a different company that disclosed a direct ransomware attack on its own bank network this same week, already faces four class-action lawsuits filed within a month.

The Takeaway: If you're the client in a vendor relationship like Amgen's, pull your top vendor contracts this month and check the liability cap. If a real breach would blow past it in the first call to outside counsel, negotiate a data-breach carve-out now, before you need one. If you're the vendor, keep your SOC 2 report and cyber-insurance certificate ready to hand over before a client's audit request turns into a client's lawsuit.

Sources: Amgen 8-K · BleepingComputer on the Amgen breach (vendor unnamed, patient count unknown) · HIPAA Journal on the 60-day breach notification rule · SecurityWeek on the Cleo/Hertz zero-day breach · Justia federal docket, Jiwani v. Cleo Communications US, LLC et al. · Top Class Actions on the lawsuits naming both Hertz and Cleo · River Financial 8-K/A · StockTitan on River Financial's four class-action lawsuits

Got this forwarded to you? Subscribe at stateofthethreat.com/subscribe — one email per week, no tracking, no spam.

Know someone who needs this? Forward this email. The threats they don't know about are the ones that hurt.