Today's briefing:
Eight million people marched on March 28. What happened after dark is the operational story.
A US journalist kidnapped in Baghdad despite embassy warnings and a decade of field experience
The Lindsey Buckingham stalker attack and what it tells us about transition zone vulnerability
Welcome to your Tuesday briefing.
The Iran war is now in its fifth week. Operation Epic Fury has destroyed over 12,000 targets and fired more Tomahawk cruise missiles in a single campaign than at any point in US military history. A Tuesday deadline from the Trump administration threatens strikes on Iranian civilian infrastructure if the Strait of Hormuz does not reopen. A Pakistan-brokered ceasefire proposal is circulating. Oil is above $112 a barrel.
We will have more on all of that in Sound Smarter below, but the geopolitical picture has been the dominant story for three editions now. This week, something closer to home demands attention.
Don’t have time to read? Watch 👇
TOP STORY
After the March
On March 28, the third iteration of the decentralized No Kings protest movement drew an estimated eight million participants across 3,300 locations in the United States, making it one of the largest single-day demonstrations in American history. The demonstrations were organized primarily in opposition to the Trump administration's immigration policies, the killing of activists by federal agents, and the ongoing Iran war.
For most of the day, the marches were peaceful and heavily attended. Then the sun went down.
In downtown Los Angeles, a faction of agitators converged on the Metropolitan Detention Center following a large rally at Gloria Molina Grand Park. Individuals began tearing at the perimeter fence and launching rocks, glass bottles, and large concrete blocks at federal officers and the LAPD. Two federal agents sustained injuries requiring immediate medical attention. The LAPD declared an unlawful assembly at 5:30 PM, deployed tear gas, pepper balls, and bean bag rounds, and arrested 75 individuals, including eight juveniles. One person faced an additional felony charge for carrying a bladed weapon.
Separately, in Rancho Palos Verdes, tense confrontations developed between protesters and counter-protesters outside the Trump National Golf Club.
What the day actually looked like
The use of concrete blocks and respiratory protection by agitators in Los Angeles points to planning, not impulse. These individuals arrived prepared for a sustained confrontation and positioned themselves within a crowd that had gathered lawfully. By the time the LAPD issued a dispersal order, the options for anyone still in the area had narrowed considerably.
The No Kings movement has now produced three successive national protest days of increasing scale. The daytime events have been peaceful each time. The evening escalation has not.
Planning for a day that changes shape
Principal movements during a scheduled national day of action are a different planning problem from routine operations. The environment at 10 AM and at 7 PM on the same day can look entirely different, and routes that were clear in the morning may not be by evening. Establishing go and no-go criteria before departure, rather than reading conditions as they develop, gives a team options when things shift quickly.
Federal buildings, visible political infrastructure, and high-profile corporate addresses have consistently been the locations where escalation concentrates. A safe haven positioned away from those landmarks is worth identifying in advance.
Our take:
Eight million people participating in a single day of action is a logistical and political fact that does not fit neatly into a standard threat assessment framework. The overwhelming majority of participants were peaceful. The fraction that turned violent in Los Angeles was small. But small fractions of very large crowds still produce significant incidents, and the speed at which a lawful assembly became a tactical situation with chemical agents deployed left little margin for improvisation.
The bladed weapon recovered among the arrests is worth noting. It sits alongside the concrete blocks and respiratory gear as evidence that some of those present had thought carefully about what the evening might require. That is the picture worth carrying into the next national day of action, whenever it comes.
READER POLL
All three incidents this week had prior intelligence. What's the bigger problem?
This week’s briefing is brought to you in partnership with…
The Best Place to Invest $1,000 Right Now
This AI tech could go down in history as the crown jewel of Elon's career. It could send ChatGPT offline forever and trigger a 70X investment boom. Watch the free presentation.
MEANWHILE
Warned and Taken Anyway
On March 31, American freelance journalist Shelly Kittleson was kidnapped in broad daylight on Saadoun Street in central Baghdad. Two men pulled up in a vehicle, bundled her into the back seat, and drove away. CCTV captured the whole thing.
Iraqi security forces gave immediate chase based on checkpoint intelligence. The pursuit stretched from Baghdad into Babil province and ended when the kidnappers' primary vehicle crashed. The driver was arrested. Kittleson had already been transferred to a second vehicle and was gone.
The detained driver is a member of the 45th Brigade of the Popular Mobilization Forces, a unit with direct ties to Kataib Hezbollah, an Iranian-aligned militia with a documented history of targeting Western nationals.
What makes this case particularly significant is what was known beforehand. The US Embassy had warned Kittleson multiple times about specific and credible threats against her. Intelligence suggested her name was on a targeted list held by Kataib Hezbollah. She had previously tried to enter Iraq from Syria weeks earlier and was turned back due to security concerns directly linked to the Iran war. She entered Baghdad days before her capture and was staying alone in a modest hotel.
Kittleson is not an inexperienced operator. She has reported across the Middle East for a decade and has completed hostile environment training. A paramilitary group with a dedicated intelligence capacity and an active target list is a different category of threat from the general risks that training and experience are designed to manage.
A low profile in a modest hotel offers nothing when the group looking for you already knows your name. Journey management in this environment means armored transport, strict route variation, and a serious reckoning with what embassy threat warnings are actually saying. The Committee to Protect Journalists and the Foley Foundation have urged the US State Department to formally designate Kittleson as a hostage to unlock specialist diplomatic and military recovery resources.
The Gap Between the Car and the Door
On April 1, Lindsey Buckingham arrived for a private appointment in Santa Monica. A woman waiting outside threw an unknown liquid substance at him and fled on foot. Buckingham was not physically injured, though the nature of the substance required investigation. The LAPD's Threat Management Unit is leading the case.
The suspect is known to Buckingham from previous incidents. A permanent restraining order was granted against a woman named Michelle Dick in late 2024 after repeated trespasses at his Brentwood home, death threats to his wife's business phone, and harassment of his children online. The day after this attack, Dick gave a television interview stating she had recently approached Buckingham and was unaware the restraining order was still in effect.
The investigation confirmed that the attacker had tracked Buckingham's movements to identify the time and location of a private appointment. The appointment was private. The location was not a public venue. She found him anyway.
Transition zones, the space between a vehicle and a building entrance, are consistently where fixated individuals make their move. The principal is briefly visible, briefly predictable, and the immediate surroundings are often difficult to fully control. An attacker with enough patience can build a reliable picture of a principal's schedule without ever accessing a calendar.
The unknown substance also changes the immediate response requirement. A liquid attack of unclear composition sits in a different medical category from blunt force or ballistic injury, and an advance team that has not considered that scenario will lose time working out what to do next.
Sound even smarter:
Operation Epic Fury is now in its fifth week. The US has fired over 850 Tomahawk cruise missiles, the highest volume in a single campaign in American military history, and has suffered 365 troops wounded and 13 killed. Despite the scale of the campaign, Iran retains the capacity for asymmetric retaliation, and its mobile air defenses remain lethal: a US F-15E was shot down over Iranian territory last week, with the weapons officer evading capture in the Iranian mountains for two days before a Navy SEAL extraction. The Trump administration has issued Iran a deadline to reopen the Strait of Hormuz, threatening strikes on civilian power and water infrastructure if it is not met.
A Pakistan-brokered proposal for a 45-day ceasefire and the reopening of the Strait of Hormuz is now on the table, backed by Egypt and Turkey. China has signaled its willingness to work with Russia at the UN Security Council to ease tensions. Iran's likely response is to reject any temporary arrangement that does not include permanent sanctions relief. If talks fail before the deadline, strikes on Iranian civilian infrastructure become the next escalation point, with guaranteed retaliatory pressure on Gulf state energy and desalination plants where many multinationals base their regional operations.
SNAPSHOTS
🇺🇸 UNITED STATES -- The FBI has classified a suspected China-linked breach of its DCS-3000 surveillance system as a major incident under federal reporting standards. The compromised system processes pen register and tap-and-trace data, capturing call metadata including numbers dialed, routing information, and the identities of individuals under active federal investigation. The attack came via a commercial internet service provider rather than the FBI's own network. The Department of Justice formally notified Congress in early April.
🇸🇾 SYRIA -- Pro-Palestinian demonstrators breached the perimeter of the UAE embassy in Damascus on April 4, scaling defensive walls, tearing down the national flag, and attempting to enter the compound and the private residence of the Head of Mission. Syrian security forces intervened before a full breach. The UAE invoked the Vienna Convention on Diplomatic Relations and demanded Syria hold the perpetrators accountable. The US, Saudi Arabia, Qatar, and the Gulf Cooperation Council all condemned the incident.
🇺🇦 UKRAINE -- Ukrainian naval drones struck the Sheskharis oil terminal at the Russian port of Novorossiysk on April 5, igniting a significant fire and disrupting a major Russian energy export route. The strike compounds an already severe global energy supply picture. European buyers already cut off from Middle Eastern crude now face additional constraints on Russian volumes.
EXTRA INSIGHT
SURVEILLANCE SECURITY -- The city of Dunwoody, Georgia, paused its contract with Flock Safety, a major provider of automated license plate reader systems, after evidence emerged of potential unauthorized access to live camera feeds and AI-powered searches tracking individuals by physical description rather than plate numbers. The city council has brought in information security experts and municipal attorneys to review the platform before any renewal.
CONTRACTOR LIABILITY -- A US federal court voided a hotel's $1 million liability insurance policy after the owner falsely stated on the application that no security guards were present on the property. A contracted armed guard subsequently shot and killed a guest. The insurer successfully sued to void coverage on grounds of material misrepresentation, leaving the operator fully exposed to a wrongful death claim.
RECOMMENDED READING
Sponsored
Unlocked – Your insider access to digital safety.
Your weekly insider access to the latest breaches, cyber threats, and security tips from the experts at EveryKey.
RECOMMENDED LISTENING
Storytelling and the Protector | Mark Ledlow
In this episode of The Circuit Magazine Podcast, we sit down with Mark Ledlow, founder of the Fearless Mindset Podcast and Ledlow Security Group, to talk about storytelling for the protector.
The security profession has a visibility problem. Too many exceptional operators stay silent, letting others define the narrative around what protection looks like, what it costs, and what it's worth. Mark makes the case that getting your voice out there isn't about ego or personal brand, it's about shaping how the industry is understood by the people who fund it, regulate it, and depend on it.
But there's a tension every security professional knows: you chose this career because you operate in the grey. You're the person nobody notices until something goes wrong. So how do you step into the spotlight without compromising the very thing that makes you effective?
We explore how protectors can tell their story, earning influence, attracting talent, and elevating the profession, while staying true to the low-profile discipline that defines it.
PREVIOUS POLL - RESULTS
Q: Does NATO's collective defense framework still mean anything
🟩🟩🟩🟩🟩🟩 A. NATO coordination is dead, plan accordingly (66%)
🟨⬜️⬜️⬜️⬜️⬜️ B. This is a one-off, the alliance holds (17%)
🟨⬜️⬜️⬜️⬜️⬜️ C. Regional fractures were always inevitable (17%)
⬜️⬜️⬜️⬜️⬜️⬜️ D. Something else. let us know → [reply] (0%)
Your Comments:
SF: “NATO is on life support. Been saying this since 2016."
RP: "Free riders for decades and now they're surprised nobody's showing up."
JP: “32 countries can’t agree on what to have for lunch, let alone a war."
***
Three stories this week with a common thread running beneath them: the gap between what a plan assumes and what the environment actually delivers. The protest that turned violent after dark. The journalist who followed the embassy warning into Baghdad anyway. The appointment that a fixated person tracked and waited outside. Plans are built on assumptions. The work is knowing which assumptions to question.
See you next week.
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at https://archives.circuit-magazine.com/
To give or receive feedback, hit reply.
