Week of Sunday, July 5, 2026

For two months the Strait of Hormuz was an oil story: whether the barrels would flow and what they would cost. This week it became a compliance story, and the calm oil price is the part that will mislead you.

The market has already moved on. On Sunday the OPEC+ producers (the Organization of the Petroleum Exporting Countries plus Russia and its partners) agreed to raise output again for August, their fifth straight monthly increase. Brent crude, the international benchmark price for oil, sits near $72 a barrel, close to its pre-war level and far below the spring peak near $126. Read the price alone and the crisis is over.

Read the terms and it is only changing shape. Iran is not closing the strait or returning it to open water. It is installing a tollbooth. Tehran now says it will charge "service fees" for passage and grant "special treatment" to friendly nations, and its Khatam al-Anbiya military command warned that tankers off Iran-approved routes face an "immediate and forceful response." That is a standing tax on a fifth of the world's oil, collected at any price, and it does not go away when the headlines do.

The second change never reaches the oil page. On June 22 the US Treasury issued General License X, a 60-day authorization that makes buying Iranian crude legal until August 21, and then not. Three Japanese refiners have already opened talks to lift Iranian oil for the first time since 2019. The barrels matter less than the clock. Sanctions used to be sticky: a party was off-limits for years, and "cleared" meant cleared. Now the rule that decides who you may legally buy from is issued in short, reversible windows, and it can flip while your cargo is still at sea.

You do not have to touch Hormuz to inherit either problem. The toll lands in the freight, packaging, and power bills of companies that have never seen the Persian Gulf. The clock lands on anyone whose supplier, or whose supplier's supplier, is sourcing under a permission with an expiration date.

Everyone games out a Chinese invasion of Taiwan. The scenario Taiwan itself just practiced is quieter, more likely, and would reach your business faster.

On June 25 Taiwan ran a tabletop exercise built around a Chinese "quarantine" of the island: not an invasion, but a maritime cordon where Beijing inspects, delays, and turns back the ships going in and out, choking the island without firing on it. That same day, President Lai Ching-te ordered his agencies to expand sea and air surveillance, improve communication with commercial ships, and update Taiwan's "energy and critical supplies stockpile plans." Next month the government will drill escorting commercial vessels through a blockade. Taiwan is preparing for a siege.

A quarantine is the more dangerous case for you because it can work without ever becoming a war. Taiwan imports almost all of its energy and holds only about 11 days of liquefied natural gas. A cordon that slows shipping for a few weeks could dim the island's power and idle the factories that make most of the world's advanced computer chips, all of it below the line that would trigger a military response. It could last months. Nobody would call it a war, and your chip supply would stop anyway.

This is the same logic as the Strait of Hormuz above. A chokepoint does not have to close to hurt you. It only has to come under someone else's control.

Last month the government set the quantum deadline. This month the companies that run your systems moved it closer, and the money moving underneath tells you why.

Start with the threat, because it just accelerated. In June the White House gave federal agencies and contractors until 2030 to adopt post-quantum cryptography, the new encryption built to survive a quantum computer. On July 1 Microsoft said it would finish its own migration by 2029, a year early; Google and Cloudflare have set the same target. Microsoft's Azure chief technology officer explained why: "advances in quantum research and development have shifted the risk horizon." New results lowered the estimate of how large a quantum machine has to be to crack today's encryption. The threat moved closer, so the companies holding your data pulled their clocks forward.

The threat is only half of it, and the smaller half. Capital is pouring into quantum for the upside. Paired with artificial intelligence, a working quantum computer promises an edge on the problems that make and lose fortunes: pricing risk, modeling markets, routing supply chains, discovering drugs and materials. That prize is what put the Finnish firm IQM on the Nasdaq on July 2, billed as the first European quantum company on a major US exchange, raising $233 million. It is why China Telecom put a quantum machine on a public cloud reachable from 60 countries, and why Gulf sovereign wealth funds have been buying positions. Whoever gets useful quantum first does not just read everyone else's secrets. They out-compute the competition.

In a ransomware attack, your security team's one reliable advantage is time. The intruder breaks in, then works for hours, sometimes days or weeks, looking around, moving sideways, hunting for what matters, and somewhere in that window your monitoring is supposed to catch them. A report published July 1 shows that window closing.

An unknown attacker pointed an artificial-intelligence agent at an exposed server on the open internet and let it run. With no person steering, the agent broke in through a known flaw, moved to a production database and seized it with a second bug dating to 2021, made itself an administrator, encrypted the data, and left a ransom note. The security firm Sysdig caught the attack and gave the agent a name, JADEPUFFER. No human crew was ever identified. The software was the operator.

What makes it more than a curiosity is how it behaved. Sysdig counted more than 600 deliberate commands across the intrusion, and at one point, when a login attempt failed, the agent diagnosed its own error and fired a corrected version 31 seconds later, with nobody telling it to.

Two caveats keep this honest. It comes from a security vendor, which profits from the alarm, and Sysdig did not name the victim, describing only an exposed, neglected server. What is not in question is the thing that ran the attack, or what it means: the skill once needed to run a ransomware operation has collapsed to the cost of renting an agent, and the whole thing moved at machine speed.

A 2019 bank robbery in Midlothian, Virginia just changed the legal status of the location data sitting in your company's servers.

On June 29, 2026, the Supreme Court decided *Chatrie v. United States*. To find the robber, detectives had sent Google a geofence demand: hand over every device inside a drawn perimeter around the bank for a roughly one-hour window around the robbery. The Court ruled 6-3, in a majority opinion by Justice Elena Kagan, that people have a reasonable expectation of privacy in their phone's location history, and that compelling that data from a technology company is a search under the Fourth Amendment (the constitutional rule against unreasonable government searches). Police can still do it. Now they need a warrant backed by probable cause.

The warrant is the narrow holding. The wider one is the label. The highest court in the country has now said, in plain terms, that location data is private. *Chatrie* is a case about the government, so it does not by itself rewrite what your company owes its customers. But that "reasonable expectation of privacy" language does not stay in its lane. Plaintiffs' lawyers in the next location-data breach will quote it to argue the data was inherently sensitive and the harm was real, the two things breach suits usually struggle to prove. State privacy regulators and the Federal Trade Commission, already treating precise location as sensitive data, just got a Supreme Court sentence to cite. Brokers who buy and sell location trails are now doing it against a clearer legal headwind.

So the exposure runs past how you answer a subpoena. It reaches what a breach of your location data will cost you in court, what regulators expect of how you store it, and whether you should be collecting it at all.

Going after the marketplace instead of the seller is not new. The government shut down Silk Road and prosecuted its operator; it seized Backpage and charged the people who ran it. The lesson from Alibaba's $600 million settlement on July 1 is that the same theory now reaches a legitimate business, not just a criminal one.

Silk Road and Backpage were built for the illegal trade. Alibaba is one of the largest commercial platforms on earth, and the illegal sales at issue were a sliver of it: some 80,000 prohibited transactions over nearly nine years, about $200 million in controlled substances, regulated chemicals, and the pill-press machines used to stamp out counterfeit pharmaceuticals. The Justice Department did not accuse Alibaba of being a crime hub. It accused Alibaba of running an enormous, mostly lawful market and failing to police the unlawful corner of it. Neither Alibaba nor its affiliated US payments company, once known as Alipay US, was charged; both agreed to pay and to overhaul their controls.

Two details matter. The payments company paid alongside the marketplace, so the government reached both the storefront and the money rail. And this is a settlement, not a court ruling, so it binds no one else. What it does is show the theory has climbed out of the dark web and into mainstream commerce, where being a real business is no longer the answer to "how did that get sold on your site?"

That is why it reaches you. Your marketplace, dealer network, or procurement portal is legitimate too, and that used to be the end of the conversation.

This has been the summer of the drone. Securing the FIFA World Cup, the FBI has detected more than 1,100 drones over stadiums and seized over 500, arresting operators from Houston to Dallas. A JetBlue crew even reported a suspected drone strike on approach to New York's JFK on June 29, though investigators later found no proof of a collision. The machines are everywhere, and the ones that should worry your business are not the ones over the ballgame.

They are the ones over the refinery. Drones are cheap, hard to see, and well suited to scouting or striking the sites a country runs on: pipelines, refineries, power substations, chemical plants, data centers. And here is the bind for the companies that own them. Jamming or downing a drone is a federal crime for a private operator, because it counts as interfering with an aircraft. If one is circling your facility, you are legally reduced to watching it and calling someone else.

The law is starting to move, but not to you. The SAFER SKIES Act, signed in December, lets state and local police disable drones that threaten critical infrastructure, and pressure is building to fold drone defense into the mandatory security standards energy operators answer to. Bills that would let the operators counter drones themselves, including at nuclear plants and major substations, are still sitting in Congress. The sector is being told to solve a problem it is not yet allowed to solve alone.