Today's briefing:
Federal shutdown degrades homeland security baseline
London luxury retailers face speed-based attacks
CDC building hardening validates investment in physical barriers
Welcome to your Tuesday briefing.
The Minneapolis enforcement incidents we covered last week have now triggered a federal budget crisis that put DHS into partial shutdown on February 14.
Ninety percent of DHS employees are classified as essential, so they're still working. Just without paychecks. TSA screeners, CISA analysts, and FEMA coordinators are showing up to jobs that aren't paying them while threats don't pause for budget negotiations.
Here's the question that matters: when federal security infrastructure becomes unreliable, do you have a plan for filling that gap, or are you discovering what's missing in real time?
TOP STORY
The Government-Shaped Hole in Your Security Plan
At 12:01 AM on February 14, the Department of Homeland Security entered a partial shutdown after Senate negotiations collapsed over immigration enforcement oversight. The fatal shootings of Alex Pretti and Renee Good in Minneapolis that we covered in a previous briefing are now serving as the catalyst for this federal budget crisis.
Approximately 90% of DHS employees are classified as essential, which means they're still working. Just not getting paid. TSA screeners, CISA analysts, and FEMA coordinators are all showing up without paychecks during a period when cyber threats aren't taking a break and travel security can't afford gaps.
The question isn't whether this creates operational problems. It does. The question is whether you have a plan for when federal security infrastructure stops being a reliable constant.
The Gap You Didn't Plan For
Most security operations are built on an assumption: federal capabilities will always be there as a baseline. TSA handles airport screening. CISA shares threat intelligence. FEMA coordinates disaster response. You build your private security layer on top of that foundation.
But what happens when the foundation becomes optional?
TSA is already showing cracks. During the 2019 shutdown, sick-outs spiked as screeners looked for paying work elsewhere to cover rent and groceries. Anyone planning executive travel through major hubs like JFK, LAX, or Atlanta should expect longer lines and tired, distracted screeners. The question is whether you accounted for that when you booked the flight or whether you're about to miss a board meeting because security took three hours.
CISA presents a different problem. The automated systems keep running, monitoring critical infrastructure and scanning for threats. But the human analysts who interpret that data, write the advisories, and coordinate with private sector partners are either furloughed or working skeleton crews. If your cyber threat intelligence strategy relies on timely federal alerts, you're operating blind right now. The question is whether you have independent monitoring capabilities or whether you're waiting for an email that isn't coming.
FEMA still has $7 billion in the Disaster Relief Fund for immediate emergency response, so if a hurricane hits tomorrow, first responders will show up. But the administrative machinery that processes state reimbursements and manages long-term recovery has stopped completely. If your business continuity plan assumes FEMA coordination will help you recover from a winter storm, the bureaucratic friction just became a much bigger variable than you modeled for.
The shutdown probably won't resolve before Congress returns from recess on February 23. If it extends past one pay cycle, the degradation accelerates. More TSA callouts. More CISA analysts quietly looking for other work. More friction in the disaster recovery pipeline.
Our take:
The federal security baseline just became conditional instead of constant. The gap between what government is supposed to provide and what it can actually deliver right now is something private security operations have to fill. The companies that planned for this scenario are shifting to private aviation, running independent cyber monitoring, and maintaining direct relationships with state emergency management instead of relying on federal coordination. The companies that didn't plan for it are discovering the gap exists in real time, which is the worst possible moment to figure out your contingencies.
This isn't about whether DHS eventually gets funded again. It will. This is about whether your security planning treats federal infrastructure as a guaranteed resource or as a variable that might not be there when you need it most.
READER POLL
When federal agencies operate without funding like this, which impact hits your operations hardest?
- A. Client travel gets disrupted by TSA delays and security inconsistency
- B. Threat intelligence from CISA dries up when you need it most
- C. Coordination with federal partners becomes impossible to rely on
- D. Proving ROI on security gets harder when federal infrastructure is down
- E. Here's what actually hurts → reply
This week’s briefing is brought to you in partnership with…
Become An AI Expert In Just 5 Minutes
If you’re a decision maker at your company, you need to be on the bleeding edge of, well, everything. But before you go signing up for seminars, conferences, lunch ‘n learns, and all that jazz, just know there’s a far better (and simpler) way: Subscribing to The Deep View.
This daily newsletter condenses everything you need to know about the latest and greatest AI developments into a 5-minute read. Squeeze it into your morning coffee break and before you know it, you’ll be an expert too.
Subscribe right here. It’s totally free, wildly informative, and trusted by 600,000+ readers at Google, Meta, Microsoft, and beyond.
MEANWHILE
90 Seconds
London is experiencing a sustained wave of violent luxury retail robberies that are exposing a fundamental problem with traditional security approaches: they fail completely against speed.
On February 2, six men armed with machetes stormed a Knightsbridge Rolex store in broad daylight. The psychological dominance created by bladed weapons forced immediate staff and customer compliance while high-value watches were swept from the displays. Three suspects have been charged, but three others remain at large and are presumed to still be operational.
Five days later in Richmond, two men wearing balaclavas used a sledgehammer to breach the front window of Gregory & Co, a family jeweler, at 10:30 in the morning. They were in and out before police could respond, fleeing on foot to a waiting vehicle that had been positioned nearby.
These incidents follow a late January ram raid where an SUV was driven directly into the Yves Saint Laurent flagship store on Old Bond Street, allowing the gang to loot the premises before authorities could arrive on scene.
The pattern reveals something important: traditional retail security layers completely fail when they're up against speed. Mag-locks and security guards simply can't stop a vehicle ram or a machete charge when the entire operation is designed to be completed in under 90 seconds. Police response times become completely irrelevant when the attack window is that compressed.
The solution requires rethinking the security model from the ground up. Air-lock entry systems that require customers to be buzzed through two separate sets of doors eliminate the "rush" tactic entirely. Security fogging devices like SmokeCloak can fill a room with dense, non-toxic fog in just a few seconds, reducing visibility to zero and forcing attackers to either retreat immediately or risk getting trapped inside. For the ram-raid threat, hostile-vehicle mitigation bollards should become standard infrastructure for any high-value street-level retail location.
What 180 Rounds Couldn't Do
On a morning in February, Patrick Joseph White fired over 180 rounds from a long gun directly at the CDC headquarters in Atlanta. He shattered windows, caused extensive exterior damage to the building, and sustained the assault long enough to empty multiple magazines.
Law enforcement neutralized him, and when it was over, the building had held. He never breached the interior. No one inside was killed. The ballistic-resistant glazing and perimeter security did what they were supposed to do: they bought enough time for response.
White was driven by anti-vaccine beliefs that had festered for years after the COVID-19 pandemic. He'd talked about suicide before, fitting the pattern of someone collecting grievances until they finally act. The critical detail: White didn't own these weapons. He broke into his father's locked gun safe to get them, which means background checks on White himself would have come back clean.
Despite the volume of fire directed at the building, the physical defenses held. White couldn't get inside or kill the people that he’s targeted. That proves the CDC's investment in standoff distances and bullet-resistant windows was worth every dollar.
Organizations tied to controversial policies stay on the target list. Pharmaceutical companies, energy firms, defense contractors all operate where their business decisions can translate into someone showing up with a gun. The CDC incident shows that physical barriers turn potential massacres into survivable events.
The lesson goes beyond hardened windows. It's about having systems that can catch warning signs before someone reaches the breaking point. White had talked about killing himself; people around him knew something was wrong. The question is whether your security team has ways to hear about those signals when they come from outside the organization, not just from your own employees.
Windows rated to stop bullets or resist forced entry buy the time people inside need to lock down, hide, or evacuate before help arrives. The CDC proved it works when it matters most.
Sound even smarter:
A career criminal tried to smash into actress Anya Taylor-Joy's bedroom while she and her husband were inside their North London mansion. The intruders backed off when her husband yelled that he had a gun. Targeting the bedroom suggests they wanted the occupants themselves, probably to force them to open a safe. This is different from waiting until the house is empty and stealing quietly. High-net-worth homes require bedrooms that function as true safe rooms, with reinforced doors and independent phone lines.
CISA ordered federal agencies to immediately disconnect any network equipment that's no longer getting security updates from the manufacturer. Security cameras, video recorders, and door access systems often run on outdated firmware that hasn't been patched in years. An outdated video recorder connected to your network is an open door for hackers to access your business systems or remotely unlock your doors.
SNAPSHOTS
🇺🇦 UKRAINE – Ukrainian drones hit the Russian port of Taman on February 15, damaging oil storage tanks and starting fires just days before peace talks were scheduled to start in Geneva. Both sides keep hitting each other's energy infrastructure without letting up. Anyone managing energy assets in the Black Sea region or Eastern Europe should stay on high alert for both physical attacks and cyber intrusions, because the risk to commercial shipping remains extreme.
🇲🇽 MEXICO - Ten workers from a Canadian-owned mine in Sinaloa were kidnapped in late January. By mid-February, five bodies had been found in hidden graves. Mexican authorities said it was "mistaken identity" between warring cartels, which is exactly the problem. If the cartels can't tell the difference between a rival gang's convoy and a corporate mining convoy, then any convoy is fair game. And because the cartels are splintering into competing factions, a deal you make with one group means nothing to the others.
EXTRA INSIGHT
INDUSTRY REGULATION – Mike Cunningham has been named the new Chair of the Security Industry Authority, starting March 1. He's a former Chief Constable and ex-CEO of the College of Policing, bringing a police mindset to the regulator as the SIA assumes oversight of Martyn's Law. Expect the agency to get much tougher on enforcement, especially around fake training certificates and fraudulent licenses.
CYBER LIABILITY – Lockton Southeast agreed to $9.9 million settlement for a 2024 data breach compromising health and social security data. The precedent: failure to protect data carries massive financial liability. We're moving toward standards where security directors could face personal liability for negligence in implementing basic cyber hygiene.
RECOMMENDED READING
The $84 Billion Blind Spot
The managed cybersecurity market is projected to hit $83.96 billion by 2034, growing at nearly 17%. Those numbers matter because the clients you protect are outsourcing their cyber defense, and that creates gaps most protection teams don't see.
When your principal's organization outsources its cyber defense to a third-party provider, their digital attack surface extends well beyond what any advance team can see. If that provider is compromised, the principal's communications, travel patterns, and financial data could be exposed before anyone on the protection detail is aware.
The convergence point is unavoidable now. Smart home systems, IoT devices, digital access control, GPS tracking, connected vehicles: these are where cyber vulnerabilities become physical security problems. The client who hires a close protection team but outsources their cyber defense to an unknown managed provider has a gap in their security architecture that neither team fully understands.
PREVIOUS POLL - RESULTS
Q: If you had to expand protection to secondary family members tomorrow, what's the biggest obstacle?
🟩🟩🟩🟩🟩🟩 A. Budget constraints and justifying the expanded scope (48%)
🟨⬜️⬜️⬜️⬜️⬜️ B. Geographic distance making active monitoring impractical (18%)
🟨🟨🟨⬜️⬜️⬜️ C. Family resistance to increased security presence (26%)
🟨⬜️⬜️⬜️⬜️⬜️ D. Something else → Let us know (8%)
Your Comments:
LM: “Lack of visibility. You can’t protect what you don’t have eyes on.”
CR: “Coordination with schools and third parties. You’re dealing with lots of moving parts.”
***
The assumption that federal security infrastructure will always be there when you need it just changed from fact to maybe. TSA lines, CISA threat reports, and FEMA coordination are all running on employee goodwill instead of actual paychecks right now. When government can't do the job, private security fills the gap. The question is whether you planned for that gap or you're figuring it out on the fly.
See you next week.
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at https://archives.circuit-magazine.com/ . To give or receive feedback, hit reply.
Trusted by 125K+ IT pros
Modern IT decisions don’t come from a single headline—they come from understanding how everything connects.
IT Brew brings together the stories shaping the IT landscape, from cybersecurity and cloud to enterprise software and IT operations, so teams can see the full picture—not just isolated updates.
Less scrolling. Better context. Smarter decisions. And it’s completely free.
