EXECUTIVE PROTECTION DAILY
Tuesday, October 20, 2026 · Executive Protection Daily Team
Bottom Line Up Front
Correction to yesterday’s brief: FII10 is off. Yesterday we told readers to plan FII arrivals around Riyadh’s airport. Organizers have since postponed the Oct. 26–29 conference to 2027. Existing registrations stay valid, and new dates will be announced later. Riyadh’s airport is still effectively closed: by 13:00 local time today, a flight tracker showed no departures or arrivals and 298 of 544 flights cancelled. [1][2][3][5]
Australian MP critically injured outside her office. Independent MP Helen Haines was struck by a car outside her electorate office in Wangaratta, Victoria, and has lost a leg. Police will allege the attack was targeted. A 43-year-old local man has been charged. His family says she has been their friend for more than 20 years. [8][9]
The powder-letter wave has now reached more than three dozen congressional offices. Rep. Suhas Subramanyam’s office in Leesburg, Va., was evacuated Monday. The FBI says the envelopes went through a north Texas mail processing center and carry a “Thinking of You” postmark or stamp. Reported by The Guardian. [10][11]
Europe’s unrest is now being met with curfews and troops. France imposed overnight curfews in parts of Paris and other cities. Italy is sending 500 troops to Milan, and Albania’s protests reached a seventh day. [23][24][25][27][28]
Also today: Palestine Action has claimed the smashing of a Capital One branch on Manhattan’s Upper East Side. On the Outer Banks, N.C. 12 is closed and Hatteras Island is under a Coastal Flood Warning. Super Typhoon Champi (Rosal) is expected to hit northern Luzon and Taiwan hardest Thursday through Saturday. [12][13][36][37][44][45]
For solo operators: If your principal holds public office hours or works from a street-level office, check how close a vehicle can get to the door, and move arrivals and departures away from the curb where you can. [8] Don’t plan any Hatteras Island travel. N.C. 12 is closed north of Rodanthe, and NWS warns people could be stranded there for multiple days. [36][37] In Paris, curfew zones and gathering bans are being set city by city each day, so check before any evening movement. [23][24]
For corporate security teams: Briefing items for leadership: (1) send mailrooms the FBI’s identifiers for the letter wave (plain white envelopes, a “Thinking of You” postmark or stamp, north Texas processing), [10] (2) move any Riyadh travel to other dates or routes. FII is postponed, the U.S. Mission says Jeddah and Dammam airports are operating, and Lufthansa and Air France-KLM have suspended Riyadh into November, [1][4][6] (3) if your company uses ConnectWise Cloud Backup, keep the affected apps disabled until ConnectWise issues formal restoration instructions, [31] (4) Kenya is now at Level 3 (Reconsider Travel), so review any upcoming trips. [22]
Threats to Executives & Public Figures
Wangaratta, Australia (MP Helen Haines): Victoria Police have charged Brendan Nugent, 43, with dangerous driving causing serious injury, intentionally causing serious injury, and causing harm to a Commonwealth public official. Police say they will allege the attack was targeted. Haines, 65, was pinned between two cars outside her electorate office Monday. She has lost one leg, and doctors are fighting to save the other. Nugent is due in Wangaratta Magistrates’ Court on Wednesday. Reported by ABC News (Australia). [8]
The Guardian reports that Nugent’s family describes Haines as a family friend of more than 20 years and that the vehicle was a Toyota LandCruiser. [9]
Analyst note: The suspect was reportedly known to the victim, and the attack happened at the office door. An office open to the public is the place where a principal’s schedule is easiest to predict.
Suspicious mailings (U.S.), update: More than three dozen members of Congress have had offices targeted with white-powder envelopes. The latest was Rep. Suhas Subramanyam (D-Va.). His Leesburg district office was evacuated Monday morning, and preliminary tests found the powder was not hazardous. Law enforcement sources told ABC News that more than 100 such letters are circulating. The FBI says the envelopes were processed through a north Texas mail processing center and carry a postmark or stamp reading “Thinking of You.” No suspect has been named. Reported by The Guardian and WTOP. [10][11]
New York City (Upper East Side): At about 07:40 Monday, the windows of the Capital One branch at 249 E. 86th St. were smashed, apparently with bricks, and “PAL ACTION” and “DROP ELBIT” were stenciled in red paint. The NYPD Hate Crimes Task Force is investigating, and no injuries were reported. Reported by amNewYork. [12] Palestine Action claimed responsibility and told CBS New York it targeted the bank over its financial ties to Elbit Systems. Reported by CBS New York and ABC7. [13][14]
Analyst note: This is the second Elbit-linked direct action in our coverage in two days, after yesterday’s report on UK home attacks. Firms with any reported Elbit link should review overnight protection at their street-level sites.
San Francisco (OpenAI eavesdropping case), update: A federal magistrate judge ordered former OpenAI engineer Abdulrahman Alfozan held until a Nov. 6 preliminary hearing. The judge questioned whether a $1 million bond the Saudi government offered to guarantee would keep him from fleeing. Alfozan is accused of planting a recording device on Sept. 28 in a conference room where executives, and sometimes government officials, discussed sensitive matters. He faces one count of intercepting oral communications and has not been charged with espionage. Reported by Fortune and WIRED. [15][16]
Midtown Manhattan (E-train homicide), update: As of Monday evening, there was still no arrest in the fatal shooting of Darrel Rodriguez, 26, on the 53rd St.–7th Ave. platform Saturday. Police have released images of a person of interest in a red tracksuit and face mask. The NYPD has increased patrols in Manhattan subways. Reported by CBS New York and NBC New York. [17][18]
Mumbai (Tiger Shroff shooting), update: The three suspects arrested aboard a train at Kota were handed to Mumbai Police on a transit remand and driven toward Mumbai on Tuesday. Police say one was in contact with a suspected Lawrence Bishnoi gang associate. Reported by The Economic Times. [19] Sources told The Indian Express that the escort team turned back to Kota on Monday evening because it feared it was being followed. [20]
West Bank (Israeli candidate): Fleur Hassan-Nahoum, fifth on the People of Israel party’s list, was on a tour Monday when a stone was thrown through her car window. One passenger was reportedly hurt, and Israel Police are collecting evidence. Reported by The Jerusalem Post. [21]
Travel Advisories & Hotspots
Saudi Arabia (U.S. Mission, Oct. 19): The alert says operations at King Khalid International Airport in Riyadh “remain suspended,” while Jeddah and Dammam airports are operating with some delays and cancellations. All land border crossings, including the King Fahd Causeway to Bahrain, are open. U.S. government staff need Chief of Mission authorization to use any Saudi airport. [4]
The Interior Ministry warns that filming or sharing information about counter-missile and counter-drone activity or impact sites “exposes you to legal liability,” and U.S. citizens have been detained for taking photos of airports and impact sites. [4]
Action: Brief principals and traveling staff not to photograph or post about interceptions, debris or government sites.
Houthi claims: The Houthis said Monday they had struck the Shaybah oil field, King Khalid International Airport, Abha airport and Saudi military sites over the past 48 hours. Saudi authorities did not comment right away. Reported by Anadolu Agency. [7]
Kenya (State Dept., Oct. 19): Raised to Level 3 (Reconsider Travel) over health, crime, kidnapping, terrorism, unrest and traffic-safety risks. The CDC has issued a Travel Health Notice for Ebola (Bundibugyo virus) in Kenya. The Level 4 “Do Not Travel” areas still include Nairobi’s Eastleigh and Kibera neighborhoods. Travelers coming from Ebola-affected or higher-risk countries must fill out an electronic health form and may be temperature-screened on arrival. [22]
Civil Unrest in Business Hubs
France: Overnight curfews began Monday. In Paris they run from 23:00 to 06:00 at Place de la République and in the Les Halles area, and unauthorized gatherings are banned in other parts of the city center. Marseille, Bordeaux, Nice, Lyon, Lille and other cities have partial restrictions. More than 2,500 people have been arrested, about 1,000 police officers have been injured, and more than 2,000 businesses were directly affected. [23] PM Sébastien Lecornu said the curfews helped keep the night calm. Local officials will decide on further curfews tonight. A second round of nationwide protests, which the yellow vests are calling “Act II,” is planned for Saturday. A 40-year-old suspect has been arrested over the Limoges town hall fire. Reported by the BBC. [24] Some restrictions, especially in Bordeaux and Nice, will stay in force for several days. Reported by The Guardian (AFP). [25]
Milan, Italy: Police said more than 250 people were detained over the weekend, 80% of them minors. High-end shops in the city center closed early Monday, many boarding up their windows, and Bologna’s train station was closed as a precaution after similar disorder. Meloni chaired an emergency security meeting Monday afternoon. Reported by the BBC. [26] The government has decided to send 500 troops to Milan. Reported by The Guardian. [25] A decree law is expected to go to ministers today. Measures under discussion include extending preventive detention to minors, deferred arrest for group damage and gathering bans for people judged a threat to public order. Reported by L’Unione Sarda. [27]
Tirana, Albania (day 7): Before Monday’s clashes, officials counted 295 people injured, 186 of them police. Protesters dug up cobblestones in Rinia (Youth) Park to throw at police, who answered with water cannon and tear gas. A police station and government buildings have been attacked during the protests. PM Edi Rama says some protesters have been “radicalised by dark forces in Europe and the US.” Reported by the BBC. [28]
Aviation & Transport
Riyadh (RUH): As of 13:00 local time today, RUH Watch listed 544 flights for the day. None had departed or arrived, 298 were cancelled, two were diverted and 244 were awaiting an update. [5] Reuters reports that the airport has formally reopened, but every departure and landing needs permission from Saudi Arabia’s civil aviation authority. Reported by Reuters (via Global Banking & Finance Review). [6]
Carrier changes: Reported by Reuters. [6]
Suspended into November: Lufthansa Group (through Nov. 18) and Air France-KLM (through Nov. 7).
Suspended through late October: Akasa Air (through Oct. 27) and Air India and IndiGo (through Oct. 24).
Etihad has cancelled Abu Dhabi–Riyadh and Abu Dhabi–Dammam through Oct. 24.
Gulf Air and Qatar Airways (Riyadh and Dammam) remain suspended.
Delta has pushed its planned Atlanta–Riyadh launch to March 2027 and issued a travel waiver.
Honolulu: An Amazon Air cargo jet declared an emergency after a bomb threat and landed about 08:00 local time Monday. No explosives were found, and the aircraft was moved to Joint Base Pearl Harbor-Hickam for more screening. Reported by Hawaii News Now. [29]
U.S.: As of 10:06 UTC (06:06 ET), the FAA listed no ground stops or delay programs. John Wayne Airport (SNA) is closed overnight from 06:30 to 13:15 UTC through Oct. 23 under a NOTAM. [30]
Cyber & Doxxing Risk to Principals
ConnectWise Cloud Backup (Microsoft 365), update: In its Oct. 20 00:45 UTC update, ConnectWise said it is resetting accounts and replacing application credentials in the affected environment. Cloud Backup, SaaS Security and Cloud Management remain suspended, and backups, archive access and restores are unavailable. The company says it has seen no successful threat activity in monitored environments since its Oct. 17 mitigations. It tells partners to keep the affected apps disabled until it issues formal restoration instructions. Its next update is due by 13:00 UTC today. [31]
UK banking and cloud outage (not reported as an attack): Google Cloud has had an active incident in its London region (europe-west2) since 23:08 PDT Monday (06:08 UTC Tuesday), with problems across dozens of services. [32] Revolut reported a disruption to “multiple services,” including card payments, transfers and ATM withdrawals, and said customers’ money and data are safe. Some have linked the problems to the Google Cloud incident, but Revolut has not given a cause. Reported by the BBC. [33]
Action: Principals and staff traveling in the UK should carry a backup card from a different bank.
Insider eavesdropping: In the OpenAI case above, the device was allegedly planted in a conference room used for executive discussions. [15] Add periodic technical sweeps (TSCM) of executive meeting rooms to your program, and control who can use those rooms after hours.
Severe Weather
New York City and the Northeast (NWS): No NWS alerts were active for New York State at about 10:10 UTC. [34] NYC will be sunny today with a high near 68 and north winds around 15 mph. Wednesday will be mostly sunny with a high near 63, and Thursday sunny with a high near 67. [35] A Coastal Flood Advisory covers Ocean, Atlantic, Cape May and southeastern Burlington counties in New Jersey until 21:00 tonight. [39]
North Carolina Outer Banks (nor’easter):
NWS: A Coastal Flood Warning for Hatteras and Ocracoke islands runs until 20:00 Wednesday. NWS expects 2–4 feet of inundation, breaking waves of 9–13 feet, and possible flooding of vulnerable parts of NC-12. It warns of “a possibility of being stranded on Hatteras Island for multiple days.” A Wind Advisory (north winds of 25–35 mph, gusts to 45) runs until midnight tonight. [36]
Road and evacuation status: NCDOT closed N.C. 12 between the Marc Basnight Bridge and Rodanthe on Monday evening because of ocean overwash. The mandatory evacuation order for Hatteras Island visitors remains in effect, and Ocracoke ferry service has been disrupted. Reported by Island Free Press. [37]
Virginia and Maryland coasts (NWS): Coastal Flood Advisories cover Virginia Beach, eastern Currituck, Norfolk and Hampton Roads, and the Maryland beaches. Most run into Thursday, Oct. 22. [38]
Florida (NWS): A High Surf Advisory covers coastal Palm Beach County until 08:00 Wednesday. Rip Current Statements cover Miami-Dade, Broward and Palm Beach through 20:00 Thursday, and a Coastal Flood Advisory covers coastal Duval, Flagler and St. Johns until 04:00 Thursday. [40]
Southern California (NWS): Beach Hazards Statements run for the Ventura, Malibu and LA County beaches until 03:00 PDT Friday, and for the Orange and San Diego coasts until 23:00 PDT tonight. [41]
Tropics (NHC): Trudy weakened to a remnant low off Mexico, and NHC issued its final advisory at 03:00 UTC. [42] There are no tropical cyclones in the Atlantic. [43]
Super Typhoon Champi (Rosal), W. Pacific:
Philippines: At 17:00 local time, PAGASA placed the storm about 1,270 km east of Central Luzon, with 195 km/h winds and gusts to 240 km/h, moving west-northwest at 25 km/h. Wind Signal No. 1 is up for Batanes, eastern Babuyan Islands, eastern mainland Cagayan, northeastern Isabela and northeastern Catanduanes. PAGASA now says the highest likely signal is No. 2 or 3, revised from yesterday’s report of Signal 3–4. Rosal will pass closest to Extreme Northern Luzon Thursday–Friday, and a Gale Warning is in effect for the northern and eastern seaboards. [44]
Taiwan: The Central Weather Administration could issue a sea warning late Wednesday night or Thursday morning and a land warning Thursday night. The storm is expected to have its strongest effect Friday and Saturday, with possible heavy to extremely heavy rain in the north, Yilan and Hualien. Reported by Focus Taiwan (CNA). [45]
Tradecraft Tip (general guidance, not tailored advice)
Protect the public-facing office. Today’s two top threat stories both played out at a principal’s own office. In Australia, an MP was struck outside her electorate office. In the U.S., white-powder envelopes keep arriving at district offices. Walk the approach to any office your principal uses regularly. Note where a vehicle can stop or mount the curb near the door. Plan arrivals through a different entrance, or change the times, and keep a staff member watching the street while the principal is outside. In the mailroom, open mail away from where people work and post the current indicators, such as plain white envelopes, unusual postmarks and unexpected powder. Practice the drill: stop, don’t shake or sniff the item, leave the room, close the door, wash your hands and call police.
Week Ahead (Oct. 20–26)
Presidential travel (public schedule; times ET): Each stop is a political rally. Check FAA TFR listings if your principals fly into these areas. Reported by Roll Call Factba.se. [46]
Oct. 20: Greenville, N.C. (Pitt-Greenville Airport, 19:00; doors 15:30 per WITN) [47]
Oct. 21: Pendleton, S.C. (T. Ed Garrison Arena, 19:00)
Oct. 22: Sioux City, Iowa (Sioux Gateway Airport, 19:00)
Oct. 23: Fort Myers, Fla. (Alico Arena, 14:00)
Oct. 24: Macon, Ga. (19:00)
Oct. 25: Port Huron, Mich. (15:00)
New York:
Paley International Council Summit: Runs through Oct. 21 at the Paley Museum in Midtown. [48]
Greenbuild, Oct. 20–23: The conference runs at the Javits Center (445 11th Ave. at 38th St.). [49]
Early voting: Starts Saturday, Oct. 24 (09:00–17:00) and runs through Nov. 1. [50]
Washington, DC region:
Marine Corps Marathon, Sunday, Oct. 25: The race starts at 07:20 on Route 110 in Arlington.
Road closures: Arlington closures run from about 03:00 to 18:00, and southbound Route 110 closes at 16:00 Saturday. [51]
International:
Belgrade: The Student List’s final rally is at Slavija Square on Thursday, Oct. 22, at 18:00, ahead of Serbia’s Oct. 25 parliamentary election. [52] The U.S. Embassy warns of heavy police presence and road closures. [53]
France: A second round of nationwide protests is planned for Saturday, Oct. 24. [24]
Wangaratta: The accused in the Haines case is due in court Wednesday. [8]
Northern Luzon and Taiwan: Typhoon impacts are expected Thursday through Saturday. [44][45]
Removed: FII10 (Riyadh) has been postponed to 2027. [1]
Sources
FII Institute, FII10 page (checked Oct. 20) — https://fii-institute.org/conference/fii-10th-edition/
CNBC, Oct. 19 — https://www.cnbc.com/2026/10/19/saudi-arabia-postpones-fii-investor-conference-to-2027.html
The Straits Times (AFP), Oct. 20 — https://www.straitstimes.com/world/middle-east/saudi-arabia-postpones-its-davos-in-the-desert-conference-after-attacks
U.S. Mission to Saudi Arabia, Security Alert Oct. 19 — https://sa.usembassy.gov/security-alert-u-s-mission-to-saudi-arabia-october-19-2026/
RUH Watch, Riyadh flights Oct. 20 (13:00 local) — https://ruhwatch.com/en/
Reuters via Global Banking & Finance Review, Oct. 20 — https://www.globalbankingandfinance.com/factbox-airlines-cancel-flights-saudi-arabia-riyadh-airport/
Anadolu Agency, Oct. 19 — https://www.aa.com.tr/en/middle-east/houthis-claim-to-have-targeted-saudi-airports-aramco-facilities-in-past-48-hours/4093929
ABC News (Australia), Oct. 20 — https://www.abc.net.au/news/2026-10-20/brendan-nugent-charged-over-attack-against-helen-haines/107288126
The Guardian, Oct. 20 — https://www.theguardian.com/australia-news/2026/oct/20/helen-haines-alleged-attacker-brendan-nugent-charged-ntwnfb
The Guardian, Oct. 19 — https://www.theguardian.com/us-news/2026/oct/19/white-powder-envelopes-congress
WTOP, Oct. 19 — https://wtop.com/virginia/2026/10/envelope-containing-suspicious-substance-prompts-evacuation-of-va-congressmans-office/
amNewYork, Oct. 19 — https://www.amny.com/police-fire/vandalism-upper-east-side-bank-hate-crime-10192026/
CBS New York, Oct. 19 — https://www.cbsnews.com/newyork/news/bank-vandalized-upper-east-side-nypd/
ABC7 New York, Oct. 19 — https://abc7ny.com/post/upper-east-side-capital-bank-window-smashed-possible-bias-incident-investigated/19955002/
Fortune, Oct. 19 — https://fortune.com/2026/10/19/openai-alleged-bugger-alfozan-jail-saudi-court-filings-hearing/
WIRED, Oct. 19 — https://www.wired.com/story/openai-engineer-accused-of-spying-on-executives-ordered-to-remain-in-custody/
CBS New York, Oct. 19 — https://www.cbsnews.com/newyork/news/nyc-subway-station-shooting-seventh-avenue-manhattan-nypd/
NBC New York, Oct. 18 (updated Oct. 19) — https://www.nbcnewyork.com/news/local/nypd-steps-up-midtown-subway-patrols-after-deadly-station-shooting/6560630/
The Economic Times, Oct. 20 — https://economictimes.indiatimes.com/news/india/tiger-shroff-firing-case-3-accused-taken-to-mumbai-from-kota-after-transit-remand/articleshow/135062366.cms
The Indian Express, Oct. 19 (updated Oct. 20) — https://indianexpress.com/article/india/mumbai-police-team-taking-tiger-shroff-shooting-accused-turns-back-over-fears-of-being-followed-10928633/
The Jerusalem Post, Oct. 19 — https://www.jpost.com/israel-news/article-912156
U.S. Department of State, Kenya Travel Advisory, Oct. 19 — https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories/kenya-travel-advisory.html
BBC News, Oct. 19 — https://www.bbc.com/news/articles/cx30ez03djyqo
BBC News, Oct. 20 — https://www.bbc.com/news/articles/cw5yn5e8mezvo
The Guardian, Europe live, Oct. 20 — https://www.theguardian.com/world/live/2026/oct/20/france-protests-paris-curfews-italy-europe-ukraine-latest-news-updates
BBC News, Oct. 19 — https://www.bbc.com/news/articles/c6j9kwxxmxydo
L’Unione Sarda, Oct. 20 — https://www.unionesarda.it/en/italy/public-order-the-decree-arrives-preventative-detention-for-minors-a-ban-on-gatherings-for-violent-offenders-and-deferred-arrest-ddnevkzz
BBC News, Oct. 20 — https://www.bbc.com/news/articles/cmy4xjlpqgd3o
Hawaii News Now, Oct. 19 — https://www.hawaiinewsnow.com/2026/10/19/bomb-threat-prompts-emergency-screening-amazon-cargo-plane-honolulu/
FAA NAS Status (10:06 UTC) — https://nasstatus.faa.gov/api/airport-status-information
ConnectWise Trust Center, Cloud Backup advisory (updated Oct. 20, 00:45 UTC) — https://www.connectwise.com/company/trust/advisories
Google Cloud Service Health (checked Oct. 20) — https://status.cloud.google.com/
BBC News, Oct. 20 — https://www.bbc.co.uk/news/articles/cxdd8mm6qy4mo
NWS active alerts, New York — https://api.weather.gov/alerts/active?area=NY
NWS forecast, New York City — https://api.weather.gov/gridpoints/OKX/33,42/forecast
NWS active alerts, North Carolina — https://api.weather.gov/alerts/active?area=NC
Island Free Press, Oct. 19 — https://islandfreepress.org/outer-banks-news/update-n-c-12-closed-on-pea-island-due-to-ocean-overwash-significant-dune-erosion/
NWS active alerts, Virginia — https://api.weather.gov/alerts/active?area=VA
NWS active alerts, New Jersey — https://api.weather.gov/alerts/active?area=NJ
NWS active alerts, Florida — https://api.weather.gov/alerts/active?area=FL
NWS active alerts, California — https://api.weather.gov/alerts/active?area=CA
NOAA National Hurricane Center, Post-Tropical Cyclone Trudy Advisory 27 — https://www.nhc.noaa.gov/text/MIATCPEP1.shtml
NOAA National Hurricane Center, Atlantic outlook — https://www.nhc.noaa.gov/index-at.xml
PAGASA, Tropical Cyclone Bulletin #2 (17:00 PHT, Oct. 20) — https://www.pagasa.dost.gov.ph/tropical-cyclone/severe-weather-bulletin/
Focus Taiwan (CNA), Oct. 20 — https://focustaiwan.tw/society/202610200007
Roll Call Factba.se, President’s public schedule — https://rollcall.com/factbase/trump/calendar/
WITN, Oct. 20 — https://www.witn.com/2026/10/20/president-trump-holding-midterm-rally-greenville-today/
The Paley Center for Media — https://www.paleycenter.org/press-releases/pics-2026-announce
Greenbuild 2026, show information — https://informaconnect.com/greenbuild/show-information/
NYC Board of Elections — https://www.vote.nyc/election/general-election-early-voting-day-1
Arlington County, Marine Corps Marathon traffic alert — https://www.arlingtonva.us/About-Arlington/Newsroom/Articles/2026/TRAFFIC-ALERT-51st-Annual-Marine-Corps-Marathon
Srpske Novine, Oct. 19 — https://srpske.rs/en/news/politika/2026/10/19/student-list-slavija-rally-october-22-marches
U.S. Embassy Belgrade, Demonstration Alert Oct. 16 — https://rs.usembassy.gov/demonstration-alert-u-s-embassy-belgrade-serbia-october-16-2026/
Breaking alerts post first on X @EPDailyBrief, with more on Instagram and Threads @executiveprotectiondaily.
Open-source reporting only; verify before acting.