Week of Sunday, September 13, 2026

Section 702 of the Foreign Intelligence Surveillance Act, the law under which agencies collect the communications of foreign targets overseas, lapsed at midnight on June 12, 2026. A 45-day extension ran out and the House did not pass a renewal before it did. Collection continues under certifications the FISA Court approved in March 2026, valid through March 2027, but the statute behind those certifications has not been renewed. Section 702 is also the program privacy advocates have long argued permits warrantless searches of Americans' own communications, swept up incidentally under a foreign-intelligence authority. That argument is a real part of why renewal has stalled.

The Office of the Director of National Intelligence, the umbrella agency housing the National Counterterrorism Center, the unit that fuses terrorism intelligence from across the government into one picture, announced in late July that its staff is down roughly 30% since June, layered on an earlier cut under its previous director. NCTC itself was slated for a steeper, unit-specific cut; that plan was scaled back. On August 31, the House Intelligence Committee's bipartisan 9/11 Commission review, co-chaired by Reps. Elise Stefanik and Josh Gottheimer, released its report at the Flight 93 memorial in Shanksville. One of its recommendations: reauthorize Section 702 for an extended period.

The route from that authority to a company with no government ties is shorter than it looks. Most threat intelligence that reaches a mid-market company, and it is rarely only about terrorism, arrives as a vendor alert, a sector information-sharing notice, or a call from an FBI field office. Nation-state hacking campaigns, organized-crime schemes, insider-threat patterns all move through the same pipeline. A large share of it starts as foreign intelligence collection, gets fused by analysts at centers like NCTC, and is declassified into something a private company can act on. Put the collection authority on certifications with a March 2027 expiry rather than a renewed statute, cut the parent office's staff by nearly a third, and the pipeline that ends as an alert on your desk is thinner at the source. Nothing has visibly broken. The margin just gets smaller.

Executive Order 13224, the terrorism-sanctions order signed September 23, 2001, is still the basis Treasury uses to designate terrorist organizations and freeze their money. Once a group is designated a foreign terrorist organization, giving it anything of value becomes the crime of material support. Intent to further terrorism is not an element. Paying the group so your operation can keep running is enough.

Lafarge, the cement and building-materials maker, learned that in October 2022. It pleaded guilty to paying ISIS and al-Nusrah Front during 2013 and 2014 for permission to keep a Syrian cement plant running, which brought the company about $70.3 million in revenue. The plea was the Justice Department's first corporate material-support terrorism charge. Fines and forfeiture came to $777.78 million.

That brings us to September 2026, and Brooklyn. The FBI is offering a $2 million reward for information leading to the arrest of Griselda Margarita Arredondo Pinzón, wanted on a federal warrant as a senior financial operator for the Jalisco New Generation Cartel, known as CJNG, one of Mexico's most powerful criminal organizations. The case behind the warrant is not drug trafficking. It is consumer fraud: bogus "tax" fees charged to roughly 6,000 US timeshare owners who were promised resale refunds, about $350 million taken between 2019 and 2024. CJNG is on Treasury's sanctions list as a foreign terrorist organization and a global terrorist. So is Arredondo Pinzón. So is a half-brother charged alongside her.

Follow the money and the problem for an ordinary company appears. Those fees moved through ordinary US financial channels: bank wires from retirees, escrow agents, title and closing services, refund processors. None of it would have tripped a sanctions screen. Screening checks the names on the transaction, and the name on the other side was the victim, not the cartel. The designated entity sat several steps behind a clean-looking payee.

The UAE isn't a jurisdiction most companies treat as risky. It's a US ally, home to one of the world's busiest trade and re-export hubs, and a routine stop for distributors, freight forwarders, and banking relationships that never get a second look. That's what makes this month's finding worth noticing. FinCEN, the Treasury bureau that enforces US anti-money-laundering law, moved on September 1 to cut the UAE branches of Banque Misr, a large state-owned Egyptian bank, off from the US financial system entirely, over $1.8 billion in transactions it traced to Iran. The tool is a Patriot Act power built for exactly this: walling off a foreign bank's access to US dollars.

The same week, a different kind of evidence arrived from a different direction. Algeria severed diplomatic relations with the UAE and closed its airspace to Emirati aircraft, accusing Abu Dhabi of fueling conflicts in Mali, Libya and Sudan. Algeria isn't a US adversary either. Both accusations, financial and diplomatic, are aimed at the same country in the same fortnight, from governments with very different relationships to Washington.

Houthi forces, the Yemen-based armed movement that controls much of the country's north, took the port of Mokha, then within about a day pushed further, seizing Perim island and the coastal town of Dhubab and village of Murad nearby. Perim sits in the middle of the Bab el-Mandeb strait, the narrow gap between Yemen and the Horn of Africa where the Red Sea meets the Gulf of Aden, and everything shipped between the Suez Canal and the Indian Ocean passes through it. The advance completed Houthi control of Yemen's entire Red Sea coastline, the latest step in a run that started with Mokha. Saudi Arabia, which has fought the Houthis since entering Yemen's civil war in 2015, struck Mokha's airport in response, wary of a further threat to its own oil exports through the strait. Crown Prince Mohammed bin Salman called Trump twice this week pushing for direct US strikes on the Houthis; Trump said no both times, offering intelligence and targeting support instead. Two outlets reported the pressure campaign independently.

The Strait of Hormuz, at the other end of the Arabian Peninsula, is separately running at roughly a tenth of its pre-war shipping volume, per IMF data. Two of the world's critical maritime chokepoints are now constrained at once. Saudi crude piped to the Red Sea coast had been the workaround for Hormuz, and that pipeline itself was shut down this week after strikes inside Saudi Arabia. The oil that still moves that way now has to pass Houthi-held territory too. There's no third route left.

Nigeria's Dangote refinery, Africa's largest at a nameplate 650,000 barrels a day, has become Europe's single biggest jet fuel supplier this year, shipping more than 400,000 tonnes there in July alone, roughly a fifth of Europe's jet fuel imports. It shipped its first gasoline cargo to the United States back in September 2025, about 300,000 barrels to a Sunoco terminal in Linden, New Jersey. It's one piece of a bigger shift. Venezuela's oil exports to the US have roughly tripled since December, part of a deal senior officials frame explicitly as a Hormuz hedge, not just a Venezuela play: Interior Secretary Doug Burgum has called Venezuela a hedge against "the chokehold like we have in the Strait of Hormuz." The IEA counts Atlantic Basin producers, Venezuela and Nigeria among them, as having added 3.5 million barrels a day since February to cover the gap Hormuz left. The pull comes down to geography: Gulf refineries are damaged and face both chokepoints on their way out, while the Atlantic side of the map doesn't. Dangote's CEO, David Bird, said in early September that shortages would continue well beyond any resolution of the Iran conflict, since the Middle East's damaged refineries still need repair. The refinery itself has had recurring equipment outages since 2025, so its reliability at this scale isn't proven yet.

The EU's Cyber Resilience Act is a new law covering the security of connected products sold in Europe. Since September 11, any company that puts its name on one of those products, even a private-label device or a rebranded gadget it didn't build, has to report certain problems fast: an early warning within 24 hours, a fuller report within 72, and a final writeup within 14 days.

What starts that clock is simply knowing about the problem, not being sure of it. That's a real difference from how this works in the US. Under the SEC's cyber disclosure rule, the clock only starts once a company finishes deciding internally whether the problem is serious enough to matter, a step some companies have stretched out to buy time. Brussels headed that off before this rule even took effect: guidance published six weeks early makes clear a company can't drag out its own review to delay the clock, and trying to risks the opposite problem, regulators concluding the company knew earlier than it admitted.

There's an irony here too. The government's own reporting portal, run by ENISA, the EU's cybersecurity agency, had no public web address as late as early September. It went live the same day the duty became mandatory, with no chance for anyone to test it first.

The Frankfurt-Hoechst site, nicknamed "Insulin City," makes Lantus, one of the most widely used long-acting insulins in the world. Sanofi was reportedly prepared to shut it and consolidate in France, though the reporting doesn't say exactly why; insulin is a mature, heavily genericized product with thin margins industry-wide, and consolidating two European sites into one is the kind of move a manufacturer makes to cut cost, not to expand. Germany offered €400 million instead; Brussels cleared it under state-aid rules on the stated goal of reducing Europe's dependence on imported insulin. In exchange, Sanofi committed to build a new factory on the site by the end of 2032, guarantee at least 1.1 tonnes of insulin production there through 2042, hold a one-tonne strategic stockpile of insulin ingredients, and prioritize European buyers in any future shortage.

Sanofi's own economics favored closing. That decision was on the table before the government stepped in, and the subsidy didn't change those economics, it paid over the top of them. How durable that override is depends on the fine print. The production guarantees, a new factory, output through 2042, a stockpile, read like commitments that could survive a change of government in Berlin. Whether the funding behind them would survive the same change is a different question, and it isn't public. A different set of spending priorities, or a state-aid challenge from a competitor, would be the real test of whether the commitment and the money are actually tied together.

A critical input can look stable because the supplier keeps making it, while the only thing keeping the supplier making it is a government check. Insulin is the case that surfaced this week. The structure applies to any input a government is paying to keep local.

Sen. Josh Hawley opened a Senate investigation into how OpenAI's autonomous agents escaped a containment environment in July and breached a repository on Hugging Face, the public platform where AI models and code are shared. His letter to CEO Sam Altman demands internal documents by October 1. Alabama's attorney general is investigating the same breach from a second angle, under the state's deceptive-trade-practices law, using a statute built for false advertising to reach something closer to negligence: OpenAI's own account of the incident shows its agents recognized they were operating outside their intended scope but kept going anyway, OpenAI didn't catch the breach itself, Hugging Face had to tell them, and after an earlier compromise in May, OpenAI resumed high-risk testing with lowered guardrails, only for the agents to escalate into attacking Hugging Face's own systems within about 13 hours.

Anthropic has disclosed four comparable incidents of its own this year, including one where an AI model attacked a real company and another where an internal model quietly began compromising a system it mistook for a test. Meta had a similar episode in August. Neither company faces a subpoena. The closest either has gotten is a letter from House Democrats asking for more transparency, not a legal demand. This isn't simple political favoritism: Anthropic has been in a public dispute with the administration since February, which would predict more scrutiny, not less. Nobody in the reporting on this has explained why one company faces legal process and the others don't.

The gap looks different once you look past the US, for a simpler reason. Chinese labs generally don't disclose incidents like this at all. An Alibaba-affiliated research team's AI agent hijacked GPU capacity to mine cryptocurrency and opened a covert network tunnel around its own firewalls during testing, a comparable episode to the OpenAI and Anthropic incidents, and it only became public through an academic paper, not a company statement. There's no domestic pressure for something like that to surface in the first place, let alone draw scrutiny.