The most common question asked about domestic abuse is why the victim doesn’t leave. It is the wrong question, and understanding why it is wrong is the beginning of understanding everything else.

I have spent my working life in protection, and most of what I write here concerns threats that arrive from outside, the hostile surveillance, the opportunist mugger, the stranger in the crowd. This piece is about the threat that lives in the house.

Domestic abuse sits awkwardly in the security world’s usual frames, because the perpetrator is not an intruder to be kept out but a person who was invited in, trusted, and loved, and every professional instinct we have about perimeters and access control fails at the front door of a home where the danger is already inside. It is also, statistically, a far more likely threat to the people reading this than almost anything else I cover. So I want to treat it with the same seriousness this publication gives to any other threat picture, which means looking honestly at how it works, what the law now offers, and what practical protective thinking looks like for anyone living it or watching someone they love live it.

It is also, statistically, a far more likely threat to the people reading this than almost anything else I cover.

Before we start, I want to say one thing, which is that if any of this is your life right now, there is a number at the end of this article that is free, confidential and answered around the clock, and you do not need to have decided anything to call it - however, I respect that is far easier said than done.

Subscribe now

The Loop

Coercive control is the architecture of abuse, and the violence, where there is violence, is only its enforcement arm. The pattern is a gradual assumption of ownership over another person’s life. It rarely announces itself, and in the early days it often wears the costume of devotion. Wanting to know where you are all the time looks like care, wanting you all to themselves looks like romance, managing the money looks like helpfulness. Criticism of your friends and family arrives dressed as insight, they don’t really appreciate you, and each strand seems small on its own, which is precisely why the pattern is so hard to see from inside. Control is never built in a day but in increments, each one sitting just below the threshold that would trigger alarm.

By the time the pattern is established, the person inside it is isolated from the people who might have named what was happening, financially entangled or dependent, and systematically taught to doubt their own judgement. That last one matters more than any lock on any door. When someone has spent years being told that their memory of events is wrong, that their reactions are excessive, that everything wrong in the relationship originates with them, they lose the instrument a person uses to assess danger, which is trust in their own perception. I have watched highly capable people, people who run businesses and manage teams, sit in front of me unable to say with confidence whether what was happening to them was abnormal. That is not weakness, it is the intended product of a process that works.

And then there is the loop itself, the thing that answers the question we started with. Abusive relationships are almost never uniformly awful, because they cycle, with tension building until something breaks, followed by remorse, warmth, and the person you first fell in love with returning like weather. Psychologists call the mechanism intermittent reinforcement, and it is the same mechanism that makes gambling addictive.

Reward delivered unpredictably binds far more powerfully than reward delivered consistently, and when the reward is love and the alternative is fear, the bond it creates is one of the strongest attachments a human being can form. People do not stay because they are foolish, they stay because they are caught in one of the most effective behavioural traps that exists, one that has been reinforced hundreds of times, and because the practical barriers, the money, the children, the housing, the fear of what happens next, are real. And they stay for one more reason that my profession understands better than most, which is that their risk assessment is often accurate, and I will come back to that.

Trusting the Instrument

Everything in my profession begins with intuition, and I want to spend a moment defending it, because it is the faculty abuse is specifically designed to break. In protective work we are taught that intuition is not mysticism but rapid pattern recognition, the brain processing a thousand small signals faster than conscious reasoning can, and the security industry’s foundational text on the subject, Gavin de Becker’s The Gift of Fear, makes the point that violence is almost never as sudden as survivors initially describe, because when you walk it back with them, the signals were there and were noticed, and what failed was not perception but permission, the permission people give themselves to act on what they already know.

In protective work we are taught that intuition is not mysticism but rapid pattern recognition.

If you are inside the relationship, the cues rarely announce themselves as fear of the person, because the mind resists that conclusion about someone it loves, and so the signal arrives in disguise.

None of these, alone, is proof of anything. Together they form a pattern, and there is one meta-signal that sits above them all, which is the question itself. People in sound relationships do not lie awake asking whether what is happening to them is normal, and they do not find themselves searching online for the definition of coercive control at two in the morning. If you are asking the question, the asking is data, and it deserves to be treated as such rather than argued away, because as the first section of this article explained, the doubt doing the arguing was manufactured by the very situation you are trying to assess.

The cruelty of coercive control is that it degrades the instrument you would use to detect it, which is why the professional advice is not simply to trust your gut but to lend it corroboration. Say what you have noticed out loud to one person outside the relationship, or to the helpline at the end of this article, and listen to how it sounds leaving your mouth. Victims often report that they understood their situation for the first time while describing it to someone else, because speech forces the pattern out of the fog of daily normality and into a form the mind can finally examine.

The cruelty of coercive control is that it degrades the instrument you would use to detect it.

Share

What Lockdown Proved

If you want evidence that isolation is the active ingredient rather than a side effect, the pandemic provided it at national scale, because in March 2020 the state delivered every abuser’s core objective, a household cut off from outside eyes, overnight and with legal force. The United Nations came to call what followed ‘the shadow pandemic.’

Calls to the National Domestic Abuse Helpline rose 25 per cent within the first two weeks of lockdown and were running 66 per cent above pre-pandemic levels within two months, while visits to the helpline’s website, where a woman can request a safe time to be contacted, rose by 950 per cent, a tenfold increase that tells its own story about homes where even a phone call had become impossible. Sixteen women and children died in suspected domestic homicides in the first three weeks alone, the highest the Counting Dead Women project had recorded in over a decade.

But the most instructive number from that period points the other way. While helpline demand rose by two thirds, domestic abuse incidents reported to police rose by only around four per cent. That gap is the whole phenomenon in two figures. The window a victim uses to seek help, the commute, the school run, the hours a partner is out, had been closed by law, and people were reaching out through websites at three in the morning because reaching out required the one thing lockdown had abolished, which is time unobserved. The quiet in the official figures was not peace but the sound of the trap working, and it is a permanent lesson in how to read domestic abuse statistics, because recorded abuse measures the ability to report, not the reality behind the door.

And when researchers later analysed tens of thousands of police-recorded abuse crimes in detail, they found the sustained rise arrived not during lockdown but across the long period after it lifted, which will surprise nobody who has read this far. Lockdown froze thousands of relationships at the point where someone would otherwise have left, and separation delayed is danger deferred, not danger avoided. When the doors reopened, the deferred separations began, and services on both sides of the Atlantic have run above pre-pandemic levels ever since.

Nor is the gap between experience and consequence a pandemic artefact, because the most recent official figures show it is the permanent architecture of the system. In the year to March 2025, the Crime Survey estimated that 3.8 million people in England and Wales experienced domestic abuse. In the same year, police recorded around 816,000 domestic abuse crimes, the CPS charged just under 54,000 suspects, and 41,000 offenders were convicted.

What the law now recognises

For most of legal history, the criminal law could only see abuse in incidents, the assault, the injury, the broken door, while the pattern itself remained invisible to it. That changed in England and Wales in December 2015, when controlling or coercive behaviour in an intimate or family relationship became a criminal offence in its own right under section 76 of the Serious Crime Act 2015. The offence is committed where someone repeatedly or continuously engages in controlling or coercive behaviour towards a person they are personally connected to, where that behaviour has a serious effect, meaning it causes fear of violence or serious alarm and distress that substantially affects daily life, and where the perpetrator knew or ought to have known it would. It carries up to five years in prison.

The law has kept moving in the years since, and the Domestic Abuse Act 2021 widened the offence so that the victim and perpetrator no longer need to live together, which brought ex-partners and estranged family members properly within reach, and it recognised children who witness abuse as victims in their own right.

Since February last year, offenders convicted of coercive control and sentenced to twelve months or more are automatically managed under the multi-agency public protection arrangements, the same framework used for other serious offenders, which forces police, probation and other agencies to cooperate on the risk they pose. Scotland went further still, with its 2018 legislation treating coercive control as a central offence carrying up to fourteen years. None of this makes prosecution easy, because evidencing a pattern is harder than evidencing an incident, and the conviction numbers remain modest against the scale of the problem. But the significance is real all the same, because the law now officially recognises that the cage is the crime and not merely the blows.

Clare’s Law

There is one legal tool that I think remains dramatically underused, and it exists because of a woman named Clare Wood. Clare met a man on Facebook in 2007, unaware that he had a history of violence against women that was known to the police. She ended the relationship when it became controlling, and in 2009 he murdered her. Her father campaigned for years on a simple principle, that the information which might have saved his daughter existed inside the system and simply never reached her, and in 2014 the Domestic Violence Disclosure Scheme, known as Clare’s Law, was rolled out across England and Wales, with versions following in Scotland and Northern Ireland.

The scheme has two parts, and the first, the right to ask, means anyone can apply to the police for information about whether a current or former partner has a history of abuse or violence. You can apply about your own partner, and, and this is the part too few people know, you can also apply if you are worried about someone else’s partner, a daughter’s, a friend’s, a colleague’s. The second, the right to know, means police can proactively disclose to someone they believe to be at risk, without anyone asking. Disclosure is not automatic, it has to be judged lawful, proportionate and necessary to protect the person at risk, and where a third party applies, the disclosure itself is made to the person at risk rather than to the applicant, which is right, since the information belongs to her safety and not to anyone else’s curiosity.

Two honest caveats from someone who deals in risk for a living, and who has sat with people while they made these applications. I have helped individuals through the Clare’s Law process, and what I can tell you from that experience is that the application itself is straightforward, but the moment is not, because asking the question means admitting to yourself that it needs asking, and that admission is often the hardest step anyone takes. I will also tell you, without detail, that the record a disclosure reveals can be longer than anyone expected and shorter on consequences than anyone would believe. Recorded incidents do not always become charges, charges do not always become convictions, and convictions for assaulting a partner too often end in cautions and suspended sentences rather than custody, which means a history that would end a career in my industry can leave a man walking free and dating again with nothing attached to him but a file. Clare’s Law exists precisely because that file follows him silently unless somebody asks.

A clean disclosure is not a clean bill of health, because domestic abuse is chronically underreported and plenty of dangerous people have no record, so absence of information must never be read as absence of risk. And a disclosure does not make a decision for anyone. Some people receive one and stay, for all the reasons the first section of this article describes, and the disclosure has still done its work, because it has planted accurate information where gaslighting had been growing. If you take one practical thing from this article, let it be that this scheme exists, that it is free, and that you can start an application through any police force’s website or by calling 101.

Thinking like a Protection Professional

Here is where I want to offer what my trade actually knows, because the principles that protect a principal from a hostile threat translate, with care, to this situation, and one of them is uncomfortable and needs saying first.

In protective work we assess risk as a function of capability, intent and opportunity, and we pay closest attention to the moments when risk spikes rather than assuming it sits at a constant level. In domestic abuse, the research and practitioners in the field agree that the spike comes at separation. The period around leaving, and the weeks and months after, is consistently the most dangerous window in an abusive relationship, because the entire system of control is collapsing and the person who built it knows it. This is the reason the professional advice is never simply to walk out tonight, and it is the reason victims who hesitate are often reading their situation more accurately than the friends urging them to just go. I don’t want to sound dramatic, but leaving is not an act but an operation, and operations are planned.

Planning looks like this, and none of it requires having decided anything. It means speaking to the specialists first, not on your own device (more on this in the next paragraph) and then reach out to the helpline below or a local domestic abuse service, because they do safety planning every day and can connect you to an independent advisor who will know your local options. It means quietly assembling the practical foundations, identity documents, bank access, medication, essentials for children, held somewhere the other person does not control, perhaps with someone you trust. It means agreeing a code word with one or two people that means come now or call the police, and it means thinking about predictability, because the person who knows your routine best is the one you may need protection from.

And it means taking the technology seriously, because this is where the modern version of this threat lives and where my own casework has taught me the most. I have conducted technical sweeps for people being harassed and stalked by ex-partners, and the pattern repeats. The surveillance in these situations is rarely exotic. It is the shared phone plan that shows call records, the location sharing switched on years ago in happier times, the shared cloud account that mirrors photographs and messages to a device you never see, the children’s tablets, the smart doorbell, the car’s connected app, and occasionally something physical that a sweep finds and an ex-partner should never have been able to place.

What those jobs have shown me is that the client’s instinct was right long before the evidence appeared. If you feel surveilled, treat that feeling as information worth checking rather than a flaw in yourself. If you are planning to seek help, do it from a device the other person has never had access to, a work computer, a library terminal, a trusted friend’s phone, because browser histories and synced accounts report to their owner. Most police forces and the helpline can advise on a proper technology safety check before you change anything, and the order matters, because suddenly locking an abuser out of everything can itself trigger the escalation you are trying to avoid. This is exactly the kind of sequencing a protection professional thinks about, and specialists exist to think about it with you.

A few practical points on reaching out without leaving a trace, because in a controlled household the search for help is itself a risk, and these small pieces of tradecraft matter more than any of the sophisticated measures people imagine.

None of this is about deception for its own sake. It is about ensuring that the process of getting help does not raise the risk before the help arrives, which is the same principle every protective operation runs on.

If it is someone you love

The same principle of trusting the pattern applies when you are on the outside looking in, and the cues available to a watcher are different but no less readable.

The partner, meanwhile, is often perfectly charming to you, and I want to flag that disparity specifically, because it is one of the most reliable cues there is. When a person you love is visibly diminishing inside a relationship while the partner presents beautifully to the outside world, the gap between those two observations is not evidence that you are imagining things. In my line of work we would call it the signature of impression management, and de Becker would say you have already noticed what is happening and are now negotiating with yourself about whether you are allowed to believe it.

Watching someone you care about disappear into a relationship like this is its own kind of powerlessness, and most of the instinctive responses make things worse, because ultimatums isolate further, and criticism of the partner tends to be reported back and used as evidence that you are the enemy.

What you are doing, in professional terms, is keeping a channel open and holding information ready for the moment she is able to use it. That moment may take longer to arrive than you can easily bear, and the channel matters anyway.

The Numbers

This is a subject that deserves more than one article, and it will get more than one here. If you have read this far and recognised your own life in any of it, then the sentence I most want you to take away is this one. The doubt you feel about your own judgement was manufactured, the loop you are caught in was built around you, and both of those things mean it is not you, and you are not alone.

Safety and Security. From someone hired to protect.

Subscribe now

Sources

[1] Section 76, Serious Crime Act 2015, legislation.gov.uk, and CPS prosecution guidance on controlling or coercive behaviour.

[2] Home Office guidance on the Domestic Violence Disclosure Scheme (Clare’s Law), and force-level scheme pages including Avon and Somerset and West Yorkshire Police.

[3] Domestic Abuse Act 2021 provisions on personal connection and children as victims, GOV.UK factsheets.

[4] MAPPA management of coercive control offenders from February 2025 under the Victims and Prisoners Act 2024.

[5] Refuge, National Domestic Abuse Helpline.

[6] Refuge helpline demand figures during lockdown and ONS reporting on domestic abuse during the coronavirus pandemic, 2020 to 2021, with Counting Dead Women figures via the House of Commons Library.

[7] Peer-reviewed change-point analysis of police-recorded domestic abuse crimes in a UK force, Crime Science, 2023, on post-lockdown trends.

On Thursday 10 July, the former Member of Parliament Ann Widdecombe was found dead at her home in Haytor, on the edge of Dartmoor. Police believe she had been attacked the previous day and had sustained serious injuries. A 28-year-old man was arrested roughly two hundred miles away in South Yorkshire, and on Monday 13 July Counter Terrorism Policing took over the investigation, saying new information and evidence had come to light. The suspect was re-arrested on suspicion of the commission, preparation or instigation of acts of terrorism. He has not been charged, and the investigation is live, so I will say nothing here about motive, about the suspect, or about why this happened, because those are questions for the courts and not for speculation.

What I want to write about is the question this killing has forced back into public view, because it is one I am asked about often and one that is very widely misunderstood. When a public figure is harmed, the immediate response is usually to ask whether they should have had protection. It is the wrong question, or at least an incomplete one. The better question, and the one that actually matters, is who decides who receives protection in this country, on what basis, and why almost none of that process is visible to the people it is meant to serve.

How protection for political figures actually works

Most people assume that prominent politicians simply have security, in the way they might imagine it from film or television. The reality is more fragmented and considerably less reassuring.

Since the murders of Jo Cox in 2016 and Sir David Amess in 2021, both of them sitting MPs killed in their constituencies, all Members of Parliament are covered by a scheme known as Operation Bridger, which provides security advice, liaison with a local police contact, and funded protective measures for their homes and offices. That is guidance and hardware, it is not a bodyguard. Where a Member requires physical close protection, that has often been delivered not by police officers but by a private contractor, using operatives who are trained but unarmed. I have worked on the contracted side of this industry, and I will tell you plainly that the quality of what gets delivered varies enormously, because the person standing between a principal and a threat is only as good as their training, their vetting and their tasking. Some contracts get all three right. Some do not, and you would struggle to tell the difference from the outside until the day it matters.

Armed protection is a different system entirely. The decision to provide armed police protection to any individual sits with a body called the Royalty and VIP Executive Committee, known as RAVEC, which draws on assessments from the police and the security service and decides who receives what level of state protection. RAVEC is deliberately opaque. Its reasoning is not published, its decisions are not explained, and the public dispute between the Duke of Sussex and the Home Office, which reached the Court of Appeal, gave the clearest glimpse most of us will ever get of how contested and how hidden that process is. There are sound reasons for some of that secrecy, but there are also obvious costs to it, and we will come to those.

The intelligence picture

Here is the principle that sits underneath all of this, and it is the same principle whether the person being protected is a head of state, a chief executive or a former minister.

Protection should follow the threat. Not the profile, not the volume of the person's public complaints, not their politics, but a sober assessment of the intelligence picture, the risk to that specific individual at that specific time. When I co-wrote a piece about the killing of the healthcare executive Brian Thompson in From Boardroom to Battleground, the central point was that effective protective security is built on accurate risk assessment and diligent advance work, on understanding the threat before it arrives rather than reacting once it has. That has been true in every protective role I have held.

The uncomfortable truth is that a proper threat assessment is something the public can almost never see, and for good reason. It draws on intelligence, on sources and methods that cannot be exposed without endangering them, and on information about named individuals that cannot be made public. This is where the difficulty lies. The very secrecy that makes a threat assessment possible also makes it impossible for anyone outside the system to judge whether a given decision was sound. When protection is granted, we cannot see why. When it is declined or reduced, we cannot see why either. We are asked, in effect, to trust the process precisely at the moments when trust is hardest to give.

That is not an argument for opening the books. Exposing intelligence assessments would put people in danger and would help exactly the individuals these systems exist to guard against. But it is an argument for understanding, honestly, that public certainty about these decisions is almost always misplaced, in either direction. The people confidently declaring that protection was wrongly denied, and the people confidently declaring it was rightly withheld, are usually working from the same position, which is the outside, without sight of the one thing that would actually settle the matter.

The current debate

This point is being tested in real time in the argument over Nigel Farage, the leader of Reform UK, who has said publicly that he now believes he will require security for the rest of his life and has been sharply critical of the police and the Home Secretary.

The public record here is worth stating carefully, because it is more contested than the headlines suggest. According to reporting in the i Paper, Mr Farage was offered a taxpayer-funded protection package last year, including close protection, a vehicle and a trained driver, following police advice on the threats against him. The package would have put him at a broadly similar level to the leader of the opposition and senior Cabinet ministers. He turned it down. His team dispute the word ‘declined’, and their objection is worth hearing on its own terms. Their position is that the offer represented a reduction of roughly three quarters on the protection he had previously held, that the downgrade followed a review by Parliament's then security director in July 2025, and that it landed within days of the assassination of Charlie Kirk in the United States. In their words, no credible assessment could explain a fall of that size in the danger to him over a matter of days, so the party sought independent advice and paid for its own arrangements rather than accept what was offered.

Since Ann Widdecombe's death, the temperature has only risen. Reform's home affairs spokesman has claimed the state is providing no protection whatsoever to the party's MPs, and the party has begun providing its own MPs with round the clock security. The Home Secretary has announced she will look at security guidance for former MPs and for party figures outside Parliament, and has offered Mr Farage a meeting with the chair of RAVEC itself. He has accepted publicly, saying he will use it to raise the security of all Reform politicians, including those who are not MPs. It is worth pausing on what that resolution actually is. The answer to a public argument about an opaque process is a private meeting with the head of the opaque process, which the public will not see inside either. I do not say that as criticism, as realistically it may well be the only workable answer. But it tells you everything about where these decisions live.

I am not going to tell you who is right, because I cannot see what RAVEC and the parliamentary security authorities can see, and neither can anyone else offering you a confident verdict. What I can offer instead is merely a professional observation. A seventy-five per cent reduction in a protection package is either the correct output of a sound reassessment or it is a serious misjudgement, and the honest answer is that nobody outside the assessment process can know which. That is precisely the problem - when the reasoning is hidden, every outcome becomes contestable, every reduction looks like negligence to one side and every complaint looks like grievance to the other, and a question that should be settled by assessment becomes a matter of public argument instead.

The professional problem

There is a reason protecting public figures is among the most difficult work in this field, and it is not mainly about barriers or bodyguards.

People in public life are, by necessity, accessible. They hold surgeries, they attend events, they walk into television studios, they live in named homes in known places. The openness is not incidental to the role, it is the role. A democracy in which representatives are sealed away from the people they serve has lost something essential, and most politicians understand this and guard their accessibility fiercely, sometimes at real cost to their own safety. That is the tension that sits at the centre of all of this. The very quality that makes someone a functioning public servant is the quality that makes them difficult to protect. Anyone who has worked a rope line, a public event or a walkabout knows the feeling of watching a principal step towards the exact environment you would advise them to avoid, because stepping towards it is their job.

There is no clean resolution to that tension. It can only be managed, case by case, through exactly the kind of careful, unglamorous threat assessment that the public never sees and rarely credits. The murders of Jo Cox and David Amess, both attacked while doing the ordinary open work of representing their constituents, are the permanent reminder of what is at stake when the balance goes wrong.

Ann Widdecombe's death, whatever the investigation ultimately concludes, has reopened all of these questions at once. They deserve better than the certainty being offered from every direction. The honest position, the professional position, is that the people best placed to judge these decisions are the ones we can never hear from, and the people we can hear from are almost never the ones best placed to judge. Until that changes, and it may be that it cannot safely change, we are left with a harder question than the one we started with.

When we cannot see how the decision is made, how do we know whether it was made well?

Sources

[1] UK Counter-Terror Police Lead Investigation into Suspected Murder of Former Lawmaker Ann Widdecombe, CNN, July 2026.

[2] Ann Widdecombe Death: UK Counterterrorism Police Leading Probe, NBC News, July 2026.

[3] Exclusive reporting on protection arrangements offered to Nigel Farage, the i Paper, July 2026, with Reform UK's response as reported by LBC.

[4] From Boardroom to Battleground, Black Widow Security, 2026.

If you are reading this, the title has already done its job, which is mildly satisfying for me and slightly annoying for you. If it reeled you in, be honest and leave a like so I can measure the damage.

I guess that is the whole idea in miniature, the moment someone tells us not to do something, a small and slightly contrary part of us wants to do it precisely because we have been told not to. Psychologists call it reactance, the rest of us call it being human. We do not much like being told what to do, and a great deal of influence works by quietly using that fact rather than fighting it.

Subscribe now

Reverse psychology is one of the more misunderstood ideas in the popular imagination. Most people picture it as a simple trick, telling someone the opposite of what you want in the hope they will do it out of sheer defiance. It is far more than that. I admit, at its heart, it is a form of manipulation, and in my line of work it is a genuine tool. I use it in social engineering and penetration testing, the part of security where a client pays you to get into the places and systems you are not supposed to, so the gaps can be found before someone with worse intentions finds them first.

From the field

Recently I was on a job that required me to get inside a building I had no business being inside. I will keep the where and the who to myself, for obvious reasons, but the human part is what matters.

There is a version of this work that people imagine looks like the films, all lock picks and ducking beneath cameras. The truth is far more ordinary, and far more about people. The single most useful thing I did that day was tell someone I did not want to cause them any trouble.

When a member of staff hesitated about letting me through, I did not push. Pushing is what triggers suspicion, because pressure is exactly what people expect from someone trying it on. Instead, I did the opposite, I told them not to worry, that I was quite happy to wait where I was rather than get them into any bother, and that I completely understood if they would rather I did not come through at all. I took every ounce of pressure out of the situation, and in doing so I removed the very thing that would have made them wary of me.

The moment the pressure was gone, the person relaxed, and a relaxed person talks. In the few minutes that followed I was not trying to get anywhere at all. I was simply chatting, and that easy conversation told me a great deal. I learned about them, about their routine, about who came and went and when, the ordinary rhythm of the place that us security people call pattern of life. I gathered more from being reluctant to enter than I ever would have done by trying to talk my way in, because the reluctance made me safe, and feeling safe made them open.

That is reverse psychology doing real work. By appearing to want the thing less, I was given more.

What is actually happening

There is solid psychology beneath all of this, and it is worth understanding, because once you can see the mechanisms you start to notice them everywhere.

Share

How to use it, ethically, at work

You do not need to be getting into buildings for any of this to be useful. The same principles work in an inbox, a meeting and a difficult conversation, and using them to communicate more effectively is not manipulation, it is simply understanding people.

How to spot it being done to you

Here is the part that matters most, because everything I have described can of course be used on you, and not always by people with your best interests at heart.

I watched it happen not long ago while protecting one of my clients. We were in an art gallery, the gallerist having quietly sized her up, remarked that most of his buyers do not take time to think, that if they have the money and they love the piece, they simply commit. To be quite honest, it was beautifully done. In a single sentence he implied both that hesitation was for lesser buyers, and, ever so delicately, that she might not be able to afford it at all. It was pure reverse psychology, built to make her prove herself by reaching for her bankcard. She is far too sharp for that, and she let the comment sit exactly where he left it. The piece went unsold that afternoon, which I suspect bothered him a good deal more than it bothered her.

The tells are surprisingly consistent once you know them:

The single best defence is also the simplest, and it is the same one I wrote about in ‘The Art of the Con’.

Create a pause, manipulation of this kind relies on the response following hard on the heels of the trigger, before the rational part of your mind has caught up.

The moment you notice yourself feeling pushed, or oddly determined to prove a point, or quietly flattered, slow down. Ask what you would do if the emotional charge were not there. The pause is where your judgement lives, and almost nothing that is genuinely in your interest is lost by taking a moment over it.

Most people, most of the time, are simply being people. But knowing how influence works means that on the rare occasion someone aims it at you deliberately, you will recognise it for what it is, and recognising it is most of the battle.

Now, having been told at the very top not to read this, you have read all of it. I would apologise, but I think we both understand by now precisely why that happened.

Safety and Security. From someone hired to protect.

Subscribe now

Sources

I have been drawn to the relationship between terrorism and the media since I studied it at postgraduate level, and recent events have brought it sharply back into focus.

Margaret Thatcher called it the oxygen of publicity. The idea was simple, terrorists needed media attention the way a fire needs air, and denying them that attention was itself a form of counterterrorism. She said it in 1985, and the phrase has outlasted every government since, because the question underneath it has never been settled. Does covering acts of terror and violence feed the threat, or does the public’s right to know outweigh that risk? Academics have wrestled with this tension for half a century. Recent events in the United Kingdom have made it more urgent, and considerably more complicated, than it has ever been.

A relationship older than the internet

The relationship between violence and the media has always been a difficult one to characterise, because both sides arguably benefit from it. The scholar Brigitte Nacos described it as symbiotic, with those committing acts of terror relying on the media to amplify their message and induce fear, while media organisations benefit from the attention that covering attacks generates1. Brian Jenkins put it more bluntly when he wrote that terrorism is theatre2. Some academic definitions build publicity directly into the concept itself, describing terrorism as politically motivated violence in which the pursuit of publicity plays a significant role3. In that reading the violence is not the objective, instead, the audience is.

For most of modern history the oxygen Thatcher described flowed through a narrow pipe. Editors decided what was broadcast and journalists decided what was written, which at least created the possibility of restraint. That changed on 11 September 2001, when the attacks on the United States were covered globally with images broadcast on a loop, and scholars marked the moment as a turning point in the relationship between terrorism and the media4 . What followed removed the gatekeeper almost entirely. ISIS understood the emerging landscape better than any group before it, building a social media operation that flooded platforms with propaganda and turned graphic execution videos into a globally recognised brand5. When the British media nicknamed Mohammed Emwazi “Jihadi John” and grouped him with other British fighters under the pop-culture label of ‘The Beatles’, it raised an uncomfortable question about whether vivid headlines had handed a propaganda victory to the very people they were reporting on.

Subscribe now

The case on both sides

The relationship cuts both ways, and the evidence supports both halves of it, which is what makes this genuinely difficult rather than a question with an obvious answer.

On one side, there is a serious case that coverage feeds the threat. Frank Furedi has argued that outlets prioritise sensationalism over accuracy, presenting attacks as more frequent and more dangerous than they actually are6. The rolling news cycle, with its witness interviews and live updates, can make a situation feel more threatening than it is, which serves the attacker’s central aim of spreading fear out of proportion to the actual risk. David Altheide reached a similar conclusion, finding that the vivid imagery and dramatic narratives accompanying coverage contribute directly to public fear and unrest7. More recent work has put hard evidence under what these scholars argued in principle. A 2024 study in the Proceedings of the National Academy of Sciences found that ranking systems built to reward engagement measurably amplify extremism and polarisation, not as a side effect but as a direct consequence of how the systems are designed to work8.

That fear carries consequences. Analysis by the London School of Economics found that coverage in the aftermath of attacks measurably amplified Islamophobic hate crime, with Muslim communities facing what the researchers called a media-magnified likelihood of victimisation9. Hostility toward those communities then feeds the radicalisation narrative that extremist groups rely on, which offers a grievance and a supposed response to those who feel targeted10. The cycle becomes self-sustaining, and the coverage becomes part of the machinery it is describing.

On the other side, the case for coverage is just as serious, and rests on more than the abstract principle of press freedom. Denis McQuail argued that the public’s right to know about events that affect them is fundamental to a functioning democracy, and that suppressing coverage is a form of censorship11. That is not only a democratic nicety. As the Southport case will show, the absence of credible information does not produce calm. It produces a vacuum that something less reliable rushes to fill, which means restraint and silence carry their own measurable risks rather than being a neutral safe option. The media’s role as the Fourth Estate depends on its willingness to report difficult and consequential events rather than only comfortable ones. The Manchester Arena bombing in May 2017 illustrated this clearly. The coverage of the attack and the inquiry that followed did not simply describe what had happened, it exposed the specific failings of the organisations responsible for safety that night and held them publicly accountable. That accountability had a tangible legislative result. The campaign for Martyn’s Law, named for victim Martyn Hett, drew on the public pressure generated by that coverage, and the Terrorism (Protection of Premises) Act 2025 received Royal Assent in April this year, requiring venues across the country to prepare formally for the possibility of attack12. The coverage that some argued amplified the terror also forced the change designed to prevent the next one.

The same coverage that amplifies the threat can also force the change designed to prevent the next one.

What has changed

The ethical frameworks that have long governed journalism’s approach to this subject were built for a world that no longer exists. Verify before publishing, minimise harm, avoid amplifying the message, and avoid stigmatising communities. These are sound principles, but they were written for professionals working inside institutions that could be held to them.

That gatekeeping structure is precisely what has come apart, and the academic literature has begun to document the shift. A 2025 systematic review in Frontiers found that gatekeeping power has moved away from human editorial judgement toward algorithmic recommender systems, with newsrooms increasingly shaped by metric-driven visibility rather than editorial norms 13. The gatekeeper has not been replaced by another gatekeeper. It has been replaced by a system that promotes whatever generates engagement, served by millions of people who became publishers without ever being asked to think like one. The cases that demonstrate this shift in the United Kingdom are recent and specific, and their consequences were visible on the streets.

Southport is the clearest example. On 29 July 2024, Axel Rudakubana attacked a children’s dance class, murdering Bebe King, who was six, Elsie Dot Stancombe, who was seven, and Alice da Silva Aguiar, who was nine, and attempting to murder ten others14. Within hours a false name for the attacker was circulating online, alongside the claim that he was a Muslim asylum seeker who had arrived by small boat. Rudakubana had in fact been born in Cardiff., the false claims spread regardless. Amnesty International’s analysis of X found that posts falsely describing the attacker as a Muslim, a refugee or a migrant reached an estimated 27 million views within 24 hours, and that posts by a single prominent far-right figure received over 580 million views in the fortnight that followed15. Mosques were attacked, riots spread across England and Northern Ireland. A parliamentary inquiry later concluded that social media business models had incentivised the spread of the misinformation16.

Alongside the false name, a second narrative accelerated across the same platforms: the accusation of two-tier policing, the claim that authorities apply different standards to different communities. Whether that accusation holds is a contested political question beyond the scope of this piece. What is not contested is that the perception spread at the same speed as the misinformation and became part of the same charged environment. Police debunked the false name within a day, but it made little difference, because a correction rarely travels as far as the claim it is correcting, and the algorithm has no preference for which one is true.

The Vacuum

Here is the part of the Southport story that received the least attention while the disorder was unfolding. The misinformation did not defeat the truth in a fair contest, it moved into a space the truth was not permitted to enter.

Rudakubana was seventeen, which meant reporting restrictions prevented the media from naming him, and active criminal proceedings limited what the police could release. Merseyside Police confirmed quickly that the circulating name was false and that the suspect had been born in Cardiff, but they could not put a fuller account into the public domain. The false version had a name, a religion, a boat and a story. The accurate version, constrained by laws that exist to protect the fairness of a trial, had very little. The gap filled with everything else, and when it later emerged that Rudakubana had been charged with producing the biological toxin ricin and possessing an Al-Qaeda training manual, the delay in that information reaching the public fed a further wave of suspicion that the truth was being concealed.

There is a second difficult layer to this case - Rudakubana was never classified as a terrorist. Despite the ricin, the manual and a documented obsession with massacres ranging from school shootings to the Manchester Arena attack, which he had described as a good thing, he ‘held no fixed ideology’, instead he appeared fixated on violence itself. Set against the academic definition of terrorism as politically motivated violence in pursuit of publicity, he sits awkwardly on the line, a young man immersed in the methods and imagery of terror but without a cause. The law had no clear category for him. When the public was told that the worst attack on children in modern British history was not legally terrorism, many drew their own conclusions in an information environment already primed to distrust official accounts.

Share

The Reckoning

The aftermath moved in two directions at once, and both are relevant.

None of that scrutiny happens without sustained coverage. The same information environment that spread the false name also kept the failures of Prevent, the police, social services and the family in public view long enough to force an inquiry, a resignation and a structural rethink of how the country identifies dangerous young people who fit no established category. Manchester produced Martyn’s Law. Southport is reshaping Prevent. The coverage that inflamed the streets is also the coverage that is changing the system.

Southampton and Belfast

Two more recent events show both sides of this in close succession.

In Southampton, bodycam footage from the scene of Henry Nowak’s killing forced national scrutiny of how police treated a dying young man. Nowak, an eighteen-year-old student, was stabbed five times by Vickrum Digwa in December 2025. When officers arrived, Digwa falsely claimed he had been the victim of a racist assault, and the footage, released later with the family’s permission, showed officers handcuffing Nowak as he told them repeatedly that he had been stabbed and could not breathe21. A jury rejected Digwa’s account and convicted him of murder, and he was sentenced to life with a minimum of 21 years. The footage prompted an Independent Office for Police Conduct investigation, protests in Southampton, and again, prominent political claims of two-tier policing. The release of that footage is the reason any of it reached public attention at all.

In Belfast, a man was seriously injured in a knife attack in the north of the city in June 2026, losing the sight in one eye, and a Sudanese man was charged with attempted murder, possession of a knife and making threats to kill. Police stated the attack was not being treated as terrorism, and initially and incorrectly identified the suspect as Somali, an error that itself circulated online. A graphic video of the attack spread within hours and was amplified by high-profile accounts calling for protest. Disorder followed the next night - the fire service handled 256 calls and attended 62 incidents in a single evening, homes and vehicles were set alight, and families were forced to flee properties in neighbourhoods with large immigrant populations22. The contrast is not accidental. Research published in Science in 2025 found that the level of hostility people encounter in a feed shifts when the ranking behind it is changed, a reminder that the same mechanism can be tuned toward very different outcomes, and that what it produces is a matter of design rather than fate23.

The mechanism in both cases is the same. Footage travels, millions see it, and events follow at the speed of the footage. In Southampton the result was accountability for a grave institutional failure, whereas Belfast the result was disorder and families fleeing burning homes.

The oxygen of publicity is neither good nor bad. It is indifferent, and what it feeds depends on what is already alight.

We Are All Publishers Now

The ethical questions that once belonged to editors now belong to anyone holding a phone in the aftermath of a violent event, and as the post-Southport sentencing established, they carry a measure of legal responsibility for the answers whether they realise it or not.

Is this verified, or am I about to pass on something because it made me feel something? Whose dignity is in the frame, and would I want it shared if the person were someone I loved? And perhaps the hardest one, the question Southport should have taught everyone watching: am I certain, or am I simply early?

None of this argues for silence. The public’s right to know still matters, and the accountability that coverage forces is real, valuable and currently reshaping how this country approaches violence from people who fit no familiar category. What it argues for is the one thing the information environment is built to discourage, which is a pause between the feeling and the share.

Thatcher’s warning was aimed at broadcasters and editors, and it still stands. It simply applies now to a great many more people than it did in 1985. The harder question is the one we have not yet answered as a society.

When everyone holds the oxygen, who is responsible for the fire?

Safety and Security. From someone hired to protect.

Subscribe now

Sources

In 1849 a man named William Thompson walked the streets of New York approaching strangers. He was well dressed, well spoken and entirely convincing, and his question was always the same: did they have enough confidence in him to hand over their watch for safekeeping? Many did, and he walked away with it. When he was eventually arrested, the New York Herald named him a confidence man. We shortened it over time to con.

More than 170 years later the technique is unchanged, because the con artist’s first job has never been to take anything from you. It has always been to make you trust them so completely that you give it willingly.

The con artist’s first job has never been to take anything from you. It has always been to make you trust them so completely that you give it willingly

In 2025 UK victims lost more than £102 million to romance fraud alone, across 10,784 reported cases, equating to almost £280,000 lost every single day1. The average victim lost £9,500, but some individual losses reached £1 million. Those are only the cases that were reported, because one of the most reliable side effects of being conned is shame, and shame keeps people quiet.

One of the most reliable side effects of being conned is shame, and shame keeps people quiet.

Romance fraud is the most visible version of this, but it is far from the only one. The same techniques that drain someone’s life savings through a fake relationship are the techniques that have been used for decades in honey trapping, corporate espionage and state-sponsored manipulation of business people and government officials. The goal can change, but the playbook generally doesn’t.

Before we get into how it works, there is one thing worth saying directly. Most people who read this will assume it could not happen to them. Most people who have been through it assumed exactly the same thing beforehand.

Who Gets Targeted

The image most people have of a scam victim does not match the reality. The assumption tends to be someone elderly, isolated, perhaps not particularly digitally literate, someone who simply did not know better, the data however, does not support that profile.

Which? research into the psychology of scams found that fraud most consistently succeeded not when victims were naive but when they were distracted, stressed or exhausted, operating, as the researchers put it, beyond their emotional window of tolerance2 . In those moments, the mental bandwidth we normally use to question things, check things and slow down is simply not available. I’m sure we can all agree that we have been in that state, some of us, probably regularly.

The City of London Police confirm that romance fraud in 2025 affected people across every age group, every income level and every professional background3. Men submitted more reports than women, but women lost more money overall. Almost half of total losses came from people aged 55 to 74, but victims as young as teenagers and as old as their nineties were recorded, there is seemingly no profile that makes you safer.

How They Do It

The con does not begin with a request for money, by the time money is mentioned, the real work is already done.

What scammers understand, and what most of their victims do not realise until afterwards, is that the human brain operates in two modes simultaneously. There is the rational mind, which checks facts, asks questions and notices inconsistencies, and there is the emotional mind, which runs on feeling, connection and instinct. The goal of every con, from the simplest phone scam to the most elaborate romance fraud, is to move you out of your rational mind and into your emotional one, and keep you there for as long as it takes.

Which? research identified two primary tactics used to achieve this4 .

The first is relationship building.

Scammers invest significant time in making you feel known, understood and valued before they ask for anything. They remember what you told them last week and they share things about themselves that feel intimate and real. Specifically, they find similarities between your life and theirs. Research shows that people are significantly less likely to question someone they feel a connection with, regardless of how recently that connection was formed or how little they actually know about the person behind it .5

The second is urgency:

• “A problem has arisen that requires immediate action”

• “Your bank account has been compromised”

• “The investment window closes tonight”

• “The money is needed now”

Urgency works because it removes the time and space needed to think clearly. It collapses the gap between feeling and doing, which is precisely its purpose.

Any situation that demands you to act immediately, before you have had the chance to speak to someone else or simply sleep on it, should be treated as a signal rather than a deadline.

These two tactics work effectively together. The relationship lowers your guard, coupling with the urgency prevents you from raising your guard again at the critical moment.

Running beneath both of them are a set of psychological biases that scammers exploit without their victims ever noticing:

To be very clear, none of these biases are weaknesses, instead they are normal features of human cognition. They become vulnerabilities only when someone is deliberately engineering them.

[I will be writing an article on authority bias in the coming weeks]

Subscribe now

The Playbook

Once the relationship and the urgency framework are in place, the manipulation moves into a more specific set of techniques. Research into romance fraud and ‘pig butchering scams” (a form of long-term investment fraud that combines romance with fabricated financial opportunity) identified five techniques that appear consistently across almost every documented case.6

Each of these techniques serves the same function: to ensure that by the time anything is asked of you, your emotional mind is so thoroughly engaged that your rational mind has very little left to work with

Honey Trapping

Romance fraud targets individuals, honey trapping targets power.

The techniques are identical, the goal is different. Where romance fraud is most often designed to extract money, honey trapping is designed to extract information, access, leverage or compromise. It has been practised by intelligence services for centuries and it remains one of the most consistently effective tools available precisely because it exploits the same human vulnerabilities that make romance fraud so difficult to defend against.

MI5 distributed a 14-page document to hundreds of British banks, businesses and financial institutions warning explicitly that Chinese intelligence services were cultivating long-term relationships with Western business people and exploiting sexual relationships to pressurise individuals into cooperation7 . The was a response to documented operations that had already succeeded, it was not theoretical.

The targets are not chosen at random, they are selected because of what they have access to, what they know or what their cooperation would be worth. Senior executives, government officials, military personnel, anyone who holds information or influence that someone else wants are all in scope. The approach will feel like luck, like chemistry, like an unexpected connection with someone who seems to understand them in a way nobody else quite does. That feeling is manufactured with the same precision that goes into every other stage of the operation.

The digital age has expanded the reach of honey trapping considerably. LinkedIn, dating apps and social media platforms have made it straightforward to research a target in detail before making contact, to construct a persona that mirrors their interests and values, and to initiate what appears to be an organic connection without ever meeting in person - in my industry, we refer to this as social engineering. The romantic or sexual element is not always present, sometimes the trap is professional, a flattering approach about a business opportunity, a consulting arrangement, a speaking invitation. The vulnerability being exploited is not always loneliness, interestingly, the vulnerability can be ambition, or ego, or simply the pleasure of feeling recognised by someone impressive.

The psychological foundations are the same - manufactured trust, emotional manipulation, the careful exploitation of human connection. The execution is considerably more patient, the target considerably more deliberate, and the people running the operation considerably more skilled.

The Red Flags

Knowing how the playbook works makes the red flags considerably easier to spot. None of them are definitive on their own, but in combination, they are worth paying serious attention to.

The connection moves unusually fast. An intensity of interest, affection or professional flattery that arrives before it has been earned should make you pause. Genuine relationships, professional or personal, develop at a pace that reflects the reality of two people getting to know each other. When that pace is artificially accelerated, there is usually a reason.

They are never quite available in the way a real person would be. Video calls are consistently avoided, postponed or conducted under conditions that make clear identification difficult. In-person meetings are always subject to some complication. They are abroad, they are working, something always comes up. TSB research found that victims on average made eleven payments before the scam was uncovered8. In most of those cases the victim had never once seen the person they were sending money to in real time.

They ask questions that probe beyond the natural scope of the conversation. In a romance context this often means questions about financial situation, property ownership or pension arrangements. In a professional context it means questions about access, systems, colleagues or internal processes. Scammers research their targets and tailor their approach, unusually specific questions are often a sign that someone already knows more about you than the conversation would suggest.

They discourage you from talking to anyone else. This will be framed as something reasonable, privacy, or protecting the relationship, or concern that others would not understand. The people most likely to see what you cannot see are kept away from the information they would need to raise the alarm.

Your instinct is already talking. Research published in Frontiers in Psychology in 2026 found that fraud victims consistently described a point at which something had felt wrong, a moment of hesitation or unease that they dismissed, minimised or allowed to be talked away9. That feeling is not nothing, it is your rational mind trying to get a word in edgeways. When it speaks, listen to it, and do not allow someone else’s reassurance to be the reason you stop.

Read my previous article on 'Instincts'

What To Do

If something does not feel right, stop before you do anything else. The urgency you are feeling is almost certainly being created for you.

Tell someone. The isolation element of the playbook exists precisely because outside perspective is the single greatest threat to the operation. A friend, a family member, a colleague, anyone who knows you well enough to tell you honestly what they think.

Shame is the reason most people do not do this, and shame is exactly what the playbook is designed to create and exploit.

Search the images. A reverse image search of any photograph you have been sent will often reveal whether it belongs to someone else. Scammers routinely build their personas around images taken from other social media accounts, stock photography sites or legitimate public profiles. This takes less than thirty seconds and has stopped more cons than most people realise.

Never send money to someone you have not met in person, regardless of the circumstances or the explanation. The same applies to gift cards, cryptocurrency transfers or any payment method that cannot be reversed. If you are being pressured towards any of these, the pressure itself is the answer to any question you might have about whether the situation is legitimate.

If you are in the UK and believe you have been targeted, report it to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040.10 If you believe you may have been the subject of a honey trapping or professional compromise operation, speak to your organisation’s security officer before taking any other action.

This piece is not a guarantee against being targeted, because nobody can offer that. This is hopefully an understanding of how the playbook works. Thank you for reading!

Safety and Security. From someone hired to protect.

Subscribe now

Sources

When I am working away from my computer, whether on a protective security detail or any other operational task, checking nearby Bluetooth devices is something I do regularly. On the face of it that might sound like an odd habit, but it is a genuinely useful one. A list of nearby devices gives you a quiet picture of who is around you, and if you are running anti-surveillance drills, seeing the same device name appear across different locations is exactly the kind of pattern that tells you something worth paying attention to. If that is of interest, the piece I published earlier this month on surveillance awareness goes into considerably more detail.

Read The Surveillance Skills Article

So when the story of United Airlines Flight 236 landed in my news feed, what caught my attention first was not the Bluetooth device named ‘BOMB.’ It was the fact that a passenger was looking at their nearby devices at all.

Whether out of habit, boredom or something they could not quite name, a passenger on a transatlantic flight scanned their Bluetooth connections, saw a device listed as ‘BOMB’ and told a flight attendant. Reports conflict on whether the device was a speaker or a Fitbit watch, but both sources agree it belonged to a sixteen-year-old on board. What happened next turned a routine crossing into a federal security operation.

Having worked with explosives during my military service, I know what that word represents and I know why any security team encountering it has no option but to respond as though it means exactly what it says.

Whether the device was a speaker or a fitness watch is entirely beside the point.

The proportionality of the response is not what I want to discuss here, what I want to discuss is what this incident, and the pattern of incidents surrounding it, reveals about the state of aviation security in 2026, because the answer is considerably more uncomfortable than one persons poor judgement.

This is Not an Isolated Incident

The UA236 incident is one point in a pattern that has been building throughout 2026. In January a Turkish Airlines flight from Istanbul to Barcelona was intercepted by fighter jets after a passenger named their hotspot with a bomb threat. In May a KLM flight from Malaga to Amsterdam was delayed for hours for the same reason.1 A United Airlines pilot threatened FBI involvement earlier the same month after a passenger broadcast an antisemitic Wi-Fi name on board.2 In April two United flights were evacuated on consecutive days following bomb threats, and in March a Southwest Airlines passenger was removed at gunpoint after law enforcement responded to a phone alarm set for Ramadan prayer time, while Kansas City International Airport was separately evacuated with two thousand passengers inside. 34

In 2024 alone, airlines worldwide reported 2,102 unruly passenger incidents.5 That figure predates the current geopolitical environment, which has sharpened how security services respond to anything that could be construed as a threat.

This is what is driving the pattern, and it is worth understanding properly.

The Passenger Problem

A significant number of passengers board commercial aircraft with no understanding of the security environment they are entering or the consequences of their actions within it.

Naming a device ‘BOMB’ and making it visible to a cabin full of strangers at 35,000 feet activates a sequence of events that costs the airline hundreds of thousands of pounds, strands two hundred people for the better part of a day, deploys law enforcement and federal agencies, and creates genuine fear for everyone on board who don’t know what is happening.

Aviation security operates on the principle that it cannot afford to be wrong.

A security team assessing a bomb threat cannot calibrate its response to the apparent intent of the person who made it. The protocol exists because the one time a situation that looked like a joke turned out not to be would be catastrophic. That logic is not bureaucratic but simply correct, and understanding it before you board is basic literacy that most passengers do not seem to have.

Share

The Response Chain

Most passengers have no idea what actually happens when a security incident is declared on a commercial aircraft, and the gap between what they think is happening and what is actually happening is significant.

On UA236 the sequence began the moment a passenger reported the Bluetooth device to a flight attendant. The cabin crew escalated immediately to United’s operations centre in Chicago, which directed the on-board response. The flight deck squawked 7700, the universal emergency transponder code recognised by every Air Traffic Control (ATC) system in the world, which placed the aircraft on priority radar with an immediate alert and triggered a coordinated ground response.6 7 On landing, Port Authority police and federal teams were already in position, bomb disposal and canine units swept the entire aircraft, and the Transportation Security Administration (TSA) and Customs and Border Protection (CBP) conducted secondary screening of every person on board before anyone was permitted to re-board.8

From a passenger noticing a name on their phone to a full federal response on the ground in less than three hours. Every step correct was correct, but every step was completely avoidable.

The Bigger Threat Picture

The incidents described so far share something in common. They were caused by people making decisions, whether reckless, thoughtless or simply uninformed, and in theory they are preventable through awareness and education. What sits beneath that visible layer is a different category of threat entirely, one that no amount of passenger literacy can address and that most people flying today have no idea exists.

GNSS (Global Navigation Satellite System) interference is the umbrella term for deliberate disruption to the satellite signals that aircraft rely on for navigation, and it takes two primary forms:9 10

Read more

Please restack/share this article to get this important message to as many readers as possible.

Eleven people have died in open water in the United Kingdom since Sunday the 24th of May 2026. 12 Seven of them were children and teenagers, and their deaths stretched across the country from Cornwall to Yorkshire and from Wales to Hampshire, during what has been the hottest Bank Holiday weekend this country has ever recorded.

I am not writing this to create panic or to tell you not to enjoy the water. I am writing it because what has happened this week follows a pattern that repeats every summer in this country, and because the single most important thing you can do to protect yourself and the people around you, is understand something that most people simply do not know.

The water looks warm and inviting, in this heat, the surface may even feel warm. Below it, UK rivers and lakes are cold enough to stop your body working within seconds.

From My Work on the Water

Part of my work involves travelling with clients at sea, often aboard yachts, in environments where the gap between a calm day and a genuine emergency can close very quickly. Before any time on the water, these are the steps we run through. They are not complicated and they do not require specialist knowledge. They require only that you know them before you need them, because the moment you need them is not the moment you have time to learn them.

The moment you need them is not the moment you have time to learn them.

What the RNLI calls Float to Live works in a river, a lake, a reservoir and the open sea. The principle does not change with the environment.

Cold Water Shock

When your body enters cold water suddenly, it goes into shock. Your breathing becomes involuntary and completely uncontrollable, you gasp. If your face is below the water at that moment, you inhale it. Within 30 to 90 seconds, the cold causes muscular incapacitation and your ability to swim can disappear entirely, regardless of how fit you are, how strong a swimmer you are or how confident you feel going in.

This is called cold water shock and it is the reason that half of the people who drown in UK open water did not intend to enter the water at all.3 They slipped on a riverbank, they fell from a boat, or they went in to help someone else who was in trouble. The water responded to all of them in the same way.

The Royal Life Saving Society UK has confirmed that when air temperatures reach 25°C, the risk of accidental drowning increases fivefold.4 On a day of record-breaking heat, with thousands of people heading to rivers and lakes to cool down, that statistic is not abstract. It is what we have been watching play out across the country since Sunday.

‘Float to Live’

The RNLI has spent years researching and communicating this guidance, backed by scientific evidence from the University of Portsmouth’s Extreme Environments Laboratory confirming that the technique works for non-swimmers, for people who are fully clothed and in moving water as well as still.56

That is the whole technique. The difficulty is not learning it, the difficulty is remembering it in the moment when every instinct in your body is telling you to fight.

If You See Someone in Trouble

Do not enter the water. This is the instruction that saves the most lives and is ignored the most often, because the impulse to go in after someone you care about is overwhelming. A man in his sixties died this week attempting to help family members who were in difficulty.7

If you see someone struggling in open water, follow three steps:

Get help coming. Keep them floating. Do not go in.

Share

Before you go near water this summer

These are simple habits that cost nothing and take no time, but they matter enormously.

If you are a parent or a carer, please share the Float to Live technique with the young people around you before they spend time near water this summer.

Please share this with anyone you know who is heading near water. And if you have children or young people around you this week, take five minutes to show them what Float to Live looks like before they go out.

A note for international readers: the emergency numbers in this piece are UK-specific. The water safety advice and the Float to Live technique apply everywhere.

https://rnli.org/safety/float

Safety and Security. From Someone Hired to Protect.

Subscribe now

Sources

Case Study: Brian Thompson

At 06:46 in the morning on 4 December 2024, Brian Thompson, Chief Executive Officer of UnitedHealthcare, was shot three times outside the Midtown Hilton Hotel in Manhattan. He was heading to his company’s annual investor conference, and he had no security detail with him.1 The conference itself had been publicly disclosed in advance under Securities and Exchange Commission (SEC) filing requirements, which meant his location, the time of his arrival and his identity as the attending executive were matters of public record before he left his hotel room.2

This was not random. Bullet casings recovered at the scene carried the words “deny,” “defend” and “depose,” echoing widespread and long-standing public anger at UnitedHealthcare’s claim denial practices.3 The sentiment that motivated the attack had been building visibly across online platforms for years before it materialised physically, accessible to anyone monitoring the information environment around executives in the health insurance sector. His wife later confirmed that there had been prior threats.4 The attack was not an intelligence failure in the sense of missing something obscure or technical, it was a failure to look at what was already available.

Following the killing, executive security firms reported a significant surge in enquiries from corporate clients who had never previously considered protective measures. 5The Thompson incident did not create a new threat environment, it made an existing one impossible to ignore.

In our experience working on protective details, the Thompson case illustrates failures that are not uncommon in corporate security architecture and that are, individually, entirely addressable. There can be an attitude across the C-Suite of “it will never happen to me”, the data often says otherwise.

The investor conference created a fixed, publicly known location and time in advance. From a preventative perspective, prior threat indicators had been noted but not actioned. From a reactive perspective, the absence of any close protection presence meant there was no protective buffer between the principal and an uncontrolled approach route.

The broader digital environment, in which hostility toward health insurance executives had been a persistent and escalating feature for several years, had not been subject to any systematic monitoring. Each of these failures is correctable. Together, in the absence of an intelligence-led protective framework, they proved fatal.

Subscribe now

Black Widow Security - From the Field

Most close protection work looks nothing like the version people imagine. There is rarely dramatic intervention, no visible tension and, on a well-run detail, very little that the principal notices at all. The job is to make the environment safe enough that the person you are protecting can focus entirely on the work they came to do, whether that is a board meeting, a series of back-to-back client engagements or a multi-city trip through environments that carry different risks in different ways.

I have worked on protection details with senior corporate leaders across a broad range of industries, primarily financial services, and almost always as part of a team rather than as a single operator. That distinction matters, because a single body on the ground with no intelligence support is not a protection detail. It is a physical presence, and a physical presence alone is reactive by definition.

Before any principal moved, we ran advance recces on every location they were scheduled to visit. Those recces were not box-ticking exercises. They produced structured reports on the environment, covering approach routes, access points, vulnerabilities, crowd dynamics where relevant and the specific conditions that would require us to adjust the plan. Simultaneously, another operator was running continuous open-source intelligence collection to build a risk score for each leg of the day, drawing on everything publicly available about the environment, the context and any relevant threat indicators. That intelligence fed directly into how we moved, when we moved and the decisions we made on the ground in real time.

The principal was always briefed. Not with everything, and not in a way designed to create anxiety, because an anxious principal changes their behaviour and changed behaviour creates its own vulnerabilities. Our role was to be facilitators, not restrictors. The aim was always to allow the person we were protecting to do their job as normally as possible, with the risk managed around them rather than imposed on them. There is, however, a line, and when the intelligence picture demanded a different approach, that conversation happened clearly and without ambiguity.

The protest intelligence work I have undertaken is a direct extension of the same philosophy. On several occasions I have been contracted to embed within protest activity surrounding a client’s operations and report in real time to the team managing the protective operation from the outside. The principle is identical: understand the threat environment from the inside, feed that understanding into the intelligence picture and give the people making protective decisions the information they need before the situation forces their hand rather than after it already has. A team watching from outside a protest can observe behaviour. They cannot hear what is being planned, identify who is making decisions or know the difference between a crowd that is venting and a crowd that is organising. That intelligence shaped building access decisions, route planning, executive entry and exit timing and the specific windows during which it was safe to move senior leadership. Not as a replacement for the external operation, but as the dimension of it that the external operation could not generate itself.

The gap that the Thompson case exposed is not just a gap in physical capability but also a gap in intelligence architecture. The protective detail that could have made a difference that morning was not one that was bigger or more visible. It was one that had already mapped the environment, scored the risk, briefed the principal and positioned itself accordingly before Brian Thompson stepped outside.

Subscribe to Black Widow Security

St James - Bottom Line Up Front

Senior executives have become visible pressure points for activism, protest mobilisation and hybrid information operations, rather than insulated decision makers operating behind institutional brands. Traditional executive protection models focused on venues, travel and event security are increasingly misaligned with threat vectors that now develop across interconnected digital, geopolitical and personal domains.

It is likely that organisations which fail to adopt intelligence-led protective security and structured due diligence around executive exposure will face avoidable operational disruption, reputational damage and heightened duty-of-care scrutiny over the medium term. Executive targeting incidents reached their highest recorded levels in 2025, doubling year-on-year across 424 documented incidents worldwide.678

Physical activity accounts for 85 percent of those incidents, including assaults, kidnappings, stalking and protest-related actions, and one third of all incidents resulted in injury or death.9 The executive protection industry, valued at $427.8 million in 2024, is projected to nearly double to $853.7 million by 2032, with 72 percent of security professionals citing an increase in public threats against executives as the primary driver of enhanced protective measures.10

This shift matters because most executive protection architectures were designed for an earlier era, one in which threats were slower, more geographically bounded and primarily physical. Today, hostility often incubates first in the information environment before manifesting in the real world, compressing warning timelines and expanding the number of actors capable of generating disruption. The Thompson case is the most visible recent illustration of this dynamic, but it is not an isolated event. It is a data point in an accelerating trend.

Subscribe to St James Briefing Room

Key Judgements

KJ1 - It is likely that targeted pressure on senior executives will increase over the near to medium term as wars, sanctions and domestic protest cycles continue to drive anger toward political and corporate elites. Recent socio-political pressures linked to pro-Palestine demonstrations, climate activism and anti-billionaire sentiment have already illustrated how geopolitical grievances translate rapidly into executive-level risk.1112

KJ2 - It is highly likely that an executive’s digital shadow, including historical statements, political donations, social media activity, publicly accessible records and family affiliations, will increasingly serve as the initial access point for harassment, protest mobilisation and reputational targeting over the near term. The Thompson case illustrates what happens when this dimension of threat intelligence is not monitored, as grievance hardened into action without generating any organisational warning.1314

KJ3 - Traditional static executive protection models are highly likely to fail against decentralised, flash-mob style protests and doxxing campaigns, as these threats bypass physical perimeters by targeting the principal’s psychological safety and private reputation. Targeting increasingly occurs at workplaces and residential addresses rather than solely at managed corporate events, with residential incidents rising sharply since 2020.1516

KJ4 - There is a realistic possibility that corporate duty-of-care expectations will expand over the medium term to include continuous digital exposure monitoring, geopolitical threat briefings and family risk assessments as standard components of executive protection programmes rather than discretionary enhancements. Boards and general counsels are increasingly exposed to personal liability where foreseeable risks to executives were not adequately addressed.17

Assessment

Geopolitics and the politicisation of leaders

The central claim of this assessment is straightforward: as geopolitics becomes more volatile, chief executives who once operated in the background are increasingly pulled into the foreground of political and social contention. Conflicts, sanctions and great-power competition are reshaping trade, finance and technology in ways that force visible, value-laden choices onto boards and executive teams.

Since the COVID-19 period, protest mobilisation has become more decentralised, digitally coordinated and personalised, narrowing the distinction between political and corporate authority figures where executives are perceived to influence socially contentious outcomes. In many jurisdictions domestic politics is more polarised, with sharper narratives about inequality, corporate power and the perceived capture of government by business interests. Executives making decisions in that environment are no longer treated as neutral technicians but are framed, fairly or not, as political actors.

It is likely that this politicisation of executive decision making will persist over the near to medium term. Decisions about health-care reform, energy transition, cost-of-living measures, sensitive technologies or financial stability are now routinely framed in moral terms, where who pays, who benefits and who decided carry as much weight as the technical details of the policy or strategy itself. Once those questions are personalised, senior leaders become natural focal points for public anger and organised campaigns, moving executive risk from a narrow concern of physical security teams into a wider strategic issue for boards and resilience leaders.

The contemporary information environment amplifies this trend. Social media, partisan commentary and loosely organised online communities make it easier than ever to attach a name and face to complex grievances, and a handful of viral posts is often sufficient to recast an unknown executive as the perceived architect of an unpopular decision. For hostile or disaffected actors, the operative question becomes less how do we challenge this institution and more which person can we pressure to get a reaction, making senior leaders attractive pressure points even when they are several steps removed from the front line.

How Executives Became Pressure Points

Executives were not designed for this role. The legacy model assumed leaders operated in relatively closed spaces, shielded by institutional brands, controlled communications and physical security, with visibility largely limited to investor calls, conferences and managed media engagements. Everyday life was separate, home addresses were functionally private, and family members were rarely part of the public story unless by deliberate choice.

That separation has thinned considerably. Many executives now maintain a deliberate public profile online, engaging with staff, customers and peers under their own name, while corporate and property records are searchable at scale and conference appearances live indefinitely on video platforms. Friends, family and routines appear inadvertently in social media posts, creating a composite picture of the individual that is far richer than anything most organisations systematically map for security purposes. In effect, executives have become open-source individuals to a degree that would have been unthinkable a generation ago.

From a protective security standpoint, this openness is one of the most significant and underappreciated shifts in the executive risk environment. What an operator or a threat actor can learn about a principal’s movements, preferences, family, home location and professional schedule through open-source research alone would, in many cases, be sufficient to plan and execute a targeted approach without any specialist capability whatsoever. The Thompson investor conference is the clearest available illustration of this principle: the time, location and identity of the attending executive were matters of public record before the event took place, and no protective framework existed to account for what that public knowledge created.

For actors seeking influence, this openness is an opportunity. Targeting a named individual generates more attention and emotional energy than challenging a faceless entity, and it is considerably easier to tell a story about what this person did than to explain complex institutional processes. There is also a widespread belief, sometimes justified, that senior leaders respond more quickly to discomfort directed at them and their families than to more abstract reputational risk aimed at the organisation. These perceptions make executives an appealing route for applying pressure when other channels feel blocked or too slow, and the data reflects this clearly: residential and workplace targeting of executives has risen significantly since 2020, with activists demonstrating a consistent preference for predictable, high-visibility locations that maximise both disruption and media coverage.

Share

The Digital Shadow

Every executive carries a digital shadow, which is the accumulated and publicly accessible record of their professional and personal life as it exists across the internet. This includes their own posts, media appearances, conference schedules, company filings, property records, political donations, family members’ social media accounts and the secondary sources that reference them. For most executives, this shadow is larger, more detailed and less well understood than they realise.

The intelligence value of a digital shadow to a motivated actor is considerable. A thorough open-source profile of a senior executive can reveal predictable daily routines, residential locations, family vulnerabilities, ideological exposures, reputational weaknesses and the specific grievances most likely to be used to frame them as a target. This is not a theoretical concern. It is precisely what occurred in the period before the Thompson shooting, when online communities were actively aggregating information about executives in the health insurance sector and the sentiment environment around them had been deteriorating visibly for years.

From an operational perspective, the digital shadow is simultaneously an intelligence source and a risk surface that requires active management. As an intelligence source, systematic monitoring of a principal’s digital footprint provides early warning of emerging threats, including escalating sentiment, the appearance of personal details in activist forums, specific threats or the identification of an executive as a campaign target. As a risk surface, an unmanaged digital shadow increases the probability that a motivated actor can plan and execute a targeted approach with minimal operational effort and no specialist resources.

What we find consistently in practice is that most organisations have not yet operationalised digital shadow management as a routine component of their executive protection programme. It is typically treated as a communications or reputational function rather than a security one, which means the threat intelligence value is lost entirely and the risk surface remains unmonitored. The gap between what is visible about a principal in the open-source environment and what their security team knows about that visibility is, in most cases, significant and, in some cases, dangerous.

The Emerging Risk Surface Around Leaders

The shift from background manager to visible pressure point has generated a broader and faster-moving risk surface around executives than most organisations currently acknowledge. At least four dimensions stand out.

Physical and protest-related risk. Demonstrations have moved beyond traditional sites of power to include corporate offices, shareholder meetings, private venues and, in some cases, residential areas. The home has emerged as the most common single location for targeting incidents, a shift that reflects activist groups’ preference for environments where executives are less likely to have any protective presence. It is likely that protests targeting locations associated with executives will remain a feature of contentious issues in the near term, with consequences for the safety of families, staff and neighbours alongside operational and reputational impacts.

Digital and information risk. Executives are increasingly named, discussed and targeted online in ways once reserved for senior politicians, with doxxing, harassment campaigns and manipulated content now accompanying conventional criticism. Cyber incidents now account for fourteen percent of documented executive targeting incidents, including death threats, impersonation, swatting and account compromise, and hybrid cases that begin online before transitioning to physical behaviour represent an emerging and concerning pattern.

Travel and geopolitical exposure. Senior leaders who travel to or operate in countries involved in conflicts, sanctions regimes or sharp diplomatic disputes carry a materially different risk profile from those whose work remains domestic. Their presence can be framed by local actors as endorsement, complicity or provocation regardless of nuance, and without robust geopolitical context and protective intelligence support it is more likely than not that routine trips will intersect with unanticipated flashpoints.

Legal and reputational risk. Executives are increasingly named personally in litigation, regulatory actions, shareholder activism and public inquiries. In these cases activist materials and media coverage often move rapidly from criticising an institution to focusing on the statements, personal associations and perceived moral responsibility of specific executives, with organisations facing growing scrutiny over whether foreseeable risks to their senior leaders were adequately addressed.

Taken together, these dimensions describe an executive risk landscape that has outpaced the assumptions built into many existing protection programmes. The case for a more explicitly intelligence-led approach lies precisely in this gap between a static, logistics-centric model and a set of threats that are dynamic, narrative-driven and increasingly personalised.

Recommendations

If you would like to discuss what an intelligence-led executive protection programme looks like in practice, contact Black Widow Security. For geopolitical intelligence assessments, strategic briefings Country analysis, visit St James Briefing Room.

Subscribe to Black Widow Security

Subscribe to St James Briefing Room

Sources

I realise I have a global audience so this may not be well known to all of you, but in the UK football (soccer) league, we are currently dealing with the fallout of Spygate. What’s Spygate you’re wondering? Well, let me tell you.

I should say upfront that I have no real interest in football. I find it perfectly fine as a concept, I just don’t follow it. This week though, I’ll be honest with you, it does feel extra juicy, and that’s entirely because of Spygate.

Southampton Football Club, who were competing in the Championship play-off semi-finals against Middlesbrough, sent a member of staff to “covertly” observe Middlesbrough’s training session ahead of the match. The idea being that if you know what the opposition are planning, you have an advantage going into the game. Reasonable logic, terrible execution, enormous consequences.

(I use the word covertly loosely, and if you search for the real image of Spygate online, you will know why - though it does like quite similar to the cartoon below).

The staff member was spotted filming from behind a tree next to the training ground. When Middlesbrough staff ran towards him, he refused to identify himself and fled to the adjacent Rockliffe Hall Golf Club, where he changed his appearance in the toilets, walked through the dining room, made his way to the first tee box, and eventually disappeared into the nearby village of Hurworth.

He was identified anyway. Middlesbrough staff had photographed him at the training ground and matched the images to an official club photograph published on social media, in which he appeared alongside the Southampton manager celebrating a monthly award. The kind of detail that makes you realise the operation was compromised long before anyone started running.

And then there was the bank card.

On his way through the golf club, he used his registered payment card to buy a coffee. I cannot stress this enough, if you are attempting to conduct covert surveillance, change your appearance and disappear without trace, you do not stop to buy a coffee on a card that has your name on it. Cash is useful.

Southampton subsequently admitted to multiple breaches of regulations, not just against Middlesbrough but against Oxford United in December 2025 and Ipswich Town in April 2026 as well. They were expelled from the play-offs entirely and handed a four-point deduction to carry into next season. They appealed on May 20th, and the appeal was dismissed the same day. The Football Association has since opened its own separate investigation.

THE RULE, AND HOW WE GOT HERE

What makes this particularly interesting is that this is not the first time English football has been here. Back in 2019, Leeds United manager Marcelo Bielsa admitted he had sent staff to spy on the training sessions of every single team they played that season. Derby County were the ones who caught them, noticing a man acting suspiciously outside their training ground, and the story unravelled from there. At the time there was no specific rule against it, so Leeds were fined £200,000 under a general obligation for clubs to act towards each other in good faith, and Bielsa, being Bielsa, paid the fine himself and didn’t appear to lose a much sleep over it.

The English Football League, which governs the second and third tiers of professional football in England and is known as the EFL, then introduced Rule 127.1, which states that no club shall directly or indirectly observe, or attempt to observe, another club’s training session in the 72 hours prior to a match between them. It exists specifically because of Leeds. It has been on the books since 2019. Southampton’s head coach authorised staff to breach it anyway, and apparently did so not just against Middlesbrough but against two other clubs over the course of the season.

THE PROFESSIONAL REVIEW

Here is my issue with all of this, and it isn’t really about football. If you are going to take a risk with consequences that significant sitting at the end of it, you either do it properly or you don’t do it at all. The gap between those two options is not small.

Doing it properly means understanding the environment before you go anywhere near it. It means having a reason to be there that holds up if anyone asks. It means knowing exactly how you are leaving before you arrive. And frankly, if the stakes are high enough, it means hiring someone who does this for a living. (Although there could be a higher risk of a leak - so I appreciate why they didn’t do this).

The toilet part is where I started paying close attention, because changing your appearance when you have been compromised is actually the right instinct, it’s textbook. The problem is that changing your appearance in a golf club bathroom with whatever you happen to have on you is not a plan, it is a response to the complete absence of one.

AND FINALLY

Middlesbrough were reinstated to the final and faced Hull City at Wembley on Saturday 23rd May, in front of 84,506 people. Hull won 1-0, sending them to the Premier League.

If Hull beat Middlesbrough, Hull must have hired the professional.

(That is a joke. Probably.)

Some Southampton fans, to their credit, were apparently planning to attend future matches dressed as hedges and carrying binoculars. I’m here for it.

There is a principle widely understood in intelligence and security work, captured most famously in a line by Ian Fleming in Goldfinger.

Once is happenstance. Twice is coincidence. The third time it is enemy action.

The line is fiction, but the principle behind it is not. By the third sighting, the odds of randomness have collapsed and the only sensible response is to treat the pattern as intentional. It does not matter whether you turn out to be right or wrong. If you act on the assumption that the person you have seen three times is there deliberately, the worst case is that you have been mildly inconvenienced by your own caution. If you ignore it and turn out to be wrong about it being innocent, the worst case is significantly less forgiving. Surveillance awareness is built on the principle that the cost of being wrong in the cautious direction is almost always lower than the cost of being wrong in the trusting direction.

This is a piece about what it feels like to notice that pattern in real time, the signs to look for if you ever find yourself in the same position, and what to do once you have.

A Quick Word on Terminology

Two terms come up in this piece and they are not the same thing.

Both come up in this story, both matter.

At the time, I was on a protection detail working night shifts, securing someone whose situation had drawn attention from two very different directions. There was potential press interest because the individual we were protecting had become newsworthy, and separately, there was the potential for adverse actors with reasons of their own for wanting to reach the asset too. The team was large and experienced, mostly ex-military/ex-police, and we had been briefed that surveillance from either direction was a realistic possibility. That kind of briefing has a way of making you sharper without making you paranoid. You move through the world in roughly the same way you always do, but the filter behind your eyes shifts slightly.

I was coming off a night shift at around seven in the morning, heading home on the underground. The platform was not crowded, when I noticed a man standing at a distance, looking in my direction. Once, that means nothing. People look at each other on platforms, it is not unusual.

The tube pulled in and that is when the picture changed.

He moved towards my carriage. It was not the carriage closest to him. It was not a carriage that made sense for whatever direction he might naturally have been heading. He could have stepped on at his end of the platform and not given it a second thought. Instead he walked a stretch of the platform to make sure he boarded where I boarded.

Inside the carriage he had options. There were empty seats nearer the doors. There were empty seats at his end. He walked past several of them and sat down about five seats from me. Close enough to keep me clearly within his line of sight. Far enough to look unremarkable to anyone who was not paying attention.

Then he did the thing that confirmed it for me. He kept his rucksack on his back as he sat down. Most people take their bag off the moment they sit on a tube. They put it on their lap, on the floor between their feet, on the empty seat beside them. Anything that allows them to relax for the duration of the journey. Keeping it on while seated is uncomfortable and slightly unusual. It is also the posture of someone who has decided in advance that they may need to move quickly.

By that point I had moved from instinct to certainty. Once was nothing. Twice was the carriage choice. The seat selection and the rucksack made three, and so the pattern was complete.

Once was nothing. Twice was the carriage choice. The seat selection and the rucksack made three, and so the pattern was complete.

The priority now was not confirming what I already knew, the priority shifted to making sure he did not see where I lived. I was not going to let him follow me to my front door under any circumstances. I began running anti-surveillance drills there and then, working the route deliberately, using the environment, varying pace and direction, creating opportunities to break his line of sight without making the breaks themselves look intentional. Throughout all of this I was messaging the team and my manager, briefing them on what was happening. Reporting in real time matters -If one of us has been picked up, the working assumption has to be that others might be too, and the rest of the team needs to know so they can run their own drills on their way home. The information moves faster than the threat does and that is how you protect each other.

I was exhausted, I had just come off a twelve hour night shift and every part of me wanted to be in bed. None of that mattered anymore, the job that morning had quietly extended itself from protecting the asset to protecting my home address. Eventually I lost him. Not because he chose to break off, but because the drills worked and I thankfully left him behind.

I went home. I did not sleep particularly well.

My alarm went off at 1700, ready for the next night shift. I woke up to a series of messages on my phone explaining that a small counter-surveillance team had been quietly deployed during the day to the area around my address. They were already in position by the time I read the messages, conducting counter and waiting for me to leave for work. The plan was straightforward and elegant, in that my job was to do nothing different from any other day, while theirs was to watch the environment around me carefully for anyone who might be watching me. There was something quietly comforting about the journey in that evening, knowing that beneath the appearance of an ordinary commute I was moving through a bubble of highly skilled operators whose only job was to make sure I was safe. Anti-surveillance was not the point this time. The point was to find out whether I was still being followed, and that meant I had to become the prey.

Read more

Physical security matters enormously. The locks on your doors, the quality of your alarm system, the lighting around your property and the habits you build around access are all genuinely important, and they are things I think about and work with every day. But physical security is something most people have at least considered. The digital side of the home is where things get quietly forgotten, and in my experience it is where the most significant gaps tend to live.

When I work alongside our cyber partners to assess a client’s household, we find the same vulnerabilities repeatedly. Not because people are careless, but because nobody has ever shown them where to look or explained why it matters in plain terms.

So here are some things you can do in your own home today, without hiring anyone, without any technical background and without spending anything at all.

A Few Words You Will Need

Before we get into it, here are the terms that come up in this piece and what they actually mean.

Something We Found Recently

During a recent household assessment, we logged into a client’s router using the username admin and the password admin. Those were the factory default credentials the device had shipped with, the same ones listed publicly on the manufacturer’s website for anyone to find. The client had owned the router for two years and had simply never thought to change them.

From inside that router we could see every device connected to their home network, observe their internet activity and monitor traffic without leaving any trace. This is one of the most common things we find, and it is one of the simplest things to fix.

How to Get Into Your Router Settings

Most of the steps below require you to log into your router. To do this, open a browser on any device connected to your home WiFi and type in the address printed on the sticker on the underside of your router. Use the username and password also shown on that sticker to log in. Once you are in, you will find settings menus that cover everything mentioned.

1. Change Your Router’s Default Password

What it is: your router arrived with a preset username and password. On older routers this is often something as simple as admin or password, identical across every device that manufacturer has ever produced. Newer routers from UK providers sometimes ship with a unique password printed on the device, which is better, but still worth changing.

Why it matters: default credentials, whether generic or unique, are a known entry point. Once someone is inside your router they have full control of your home network.

What could happen if you don’t: a person with basic knowledge and access to your WiFi can see every website you visit, intercept your banking details, redirect you to fake websites without your knowledge and monitor everything that passes through your home network. You would have no way of knowing it was happening.

What to do: log into your router, find the admin password section and change it to something long and unique. Write it down and keep it somewhere safe.

2. Update Your Router’s Software

What it is: your router runs software that keeps it functioning, and that software develops flaws over time. Manufacturers release updates to fix those flaws, but the updates only work if you install them.

Why it matters: criminals actively scan for routers running outdated software because the weaknesses in older versions are publicly documented. An unpatched router is a known, published vulnerability, in the same way that a broken lock on a back gate is a known entry point to anyone paying attention.

What could happen if you don’t: someone can exploit a known flaw in your router’s software to access your network silently, without needing your WiFi password at all.

What to do: log into your router and look for a section called Firmware Update or Software Update. Install anything available and check back every few months.

3. Rename Your WiFi Network

What it is: the name your WiFi broadcasts to nearby devices. Most routers come set up with a default name that includes the manufacturer or your internet provider alongside a short code, something like BTHub6-A2B3 or SKY-X4Y5Z. Many people also rename their network to something personal like SmithFamilyWifi or their house number.

Why it matters: a default name tells anyone within range exactly which router model you are running, which makes it straightforward to look up known vulnerabilities for that device. A personal name adds your identity on top of that.

What could happen if you don’t: you are advertising the specific tool a criminal needs to find a way in, and potentially your identity alongside it.

What to do: log into your router, find the WiFi settings and change the network name to something completely neutral that reveals nothing about you, your address or your equipment.

4. Create a Separate Network for Smart Devices

What it is: most modern routers allow you to run two separate WiFi networks at the same time. One for your personal devices and one for everything else.

Why it matters: your smart TV, your video doorbell, your voice assistant and your baby monitor all carry weaker security than your phone or laptop. If any one of them is compromised, it can be used as a bridge to reach every other device on the same network.

What could happen if you don’t: a criminal who gets into your smart TV can use it as a stepping stone to access your laptop, your phone and anything sensitive stored on either of them.

What to do: log into your router and look for a Guest Network option in the WiFi settings. Create one and move every smart device onto it. Keep your main network for your phone, your laptop and anything that holds personal or financial information.

Your devices are only as secure as the weakest thing they share a network with.

5. Check What Is Connected to Your Network

What it is: your router keeps a list of every device currently connected to your home network. Most people have never looked at it.

Why it matters: in our assessments, clients regularly find devices they do not recognise. An old phone they forgot about, a previous visitor’s tablet that never disconnected or occasionally something they cannot account for at all.

You cannot protect a network if you do not know what is on it.

What could happen if you don’t: someone may already be connected to your home network and observing your activity. Without checking, you have no way of knowing.

What to do: log into your router and find the section showing connected devices. Go through the list carefully. If something does not belong, disconnect it and change your WiFi password.

None of the above should require professional help. It requires around twenty minutes, a willingness to look at something most people never look at and the understanding that physical security and digital security are not two separate things. They are two sides of the same door.

The clients who ask us to assess their home are not the ones who think they have a problem. They are the ones who understand that assuming you don’t is the most common vulnerability of all.

Safety and Security. From someone hired to protect.

Subscribe now

If you would like to know more about what a full household security assessment covers, you can find us at blackwidowsecurity.co.uk

I am going to start with the part that is hardest to admit.

I work in personal security. I have spent years advising people on how to protect themselves, their assets and their data. I have worked in environments where situational awareness was not a professional courtesy but a necessity. And on an early morning in a quiet suburb of London, someone reached over my shoulder and snatched my phone out of my hand before I knew they were there.

I am not telling you this to perform humility. I am telling you because if it happened to me, it will happen to anyone, and I want you to take this seriously.

It was before six in the morning. I was heading to the airport for a weekend of rugby in Scotland, wheeling a suitcase along what I thought was an empty pavement. The suitcase was loud on the concrete. That matters, because I could not hear the electric bike come up behind me. There was no warning, no footsteps, no sense of anyone close. A black gloved hand came over my shoulder, tugged the phone cleanly out of my grip and had accelorated before I could process what had happened.

News reports have since documented that some snatch thieves use sticky gloves specifically to improve their grip on phones. One motion, one second, and the phone does not slip.

What followed was a lesson I did not expect to need. I had to get myself to an airport and onto a flight to Scotland with no phone, no boarding pass, no maps, no Apple Pay and no way to contact anyone. I managed it, but I spent that entire journey thinking about every mistake I had made and every setting I had not turned on.

I tracked the phone, and gave the police every address it pinged - officers were sent to those addresses and phones were recovered, mine was not one of them. My phones final destination before going offline was Shenzhen, China.

I took it as a steep learning curve. This guide is everything I put in place afterwards, updated for iPhone users on iOS 17.3 and above. Some features require iOS 18. An Android version is coming soon.

The Scale of the Problem

Phone theft in London is not a niche crime, it is one of the most common crimes in the capital.

81,365 phones were stolen in London in 2024. That is roughly one every six and a half minutes, every single day of the year.

The Metropolitan Police confirmed those figures in an official press release in February 2026. In the same statement they reported that thefts fell to around 71,391 in 2025 following a year of targeted operations including Operation Swipe in the City of London, which saw a 40 per cent reduction in phone thefts in the Square Mile. During one week of action in February 2025 the Met seized 1,000 stolen phones and arrested 230 people.

That reduction is welcome. But over 70,000 phones stolen in a single city in a single year is not a solved problem. The House of Commons held a full parliamentary debate on mobile phone theft in July 2025. Members described it as a crisis.

London is the epicentre but it is not alone. Around 1.4 million phones were stolen across the United States in 2023. Latin America saw a 30 per cent increase in stolen device crime between early 2024 and early 2025, with Peru reporting over 1.7 million stolen phones in a single year. In 2024, Europol dismantled a phishing network affecting 480,000 victims worldwide that was built entirely on stolen devices.

The phones do not stay local. Operation Reckoning, the Metropolitan Police’s intelligence-led operation, disrupted a criminal network suspected of smuggling up to 40,000 stolen phones from the UK to China. The networks are international. The destination, as I can confirm from personal experience, is often Shenzhen.

What They Know That You Don’t

Snatch thieves are not opportunists in the casual sense. Many are operating as part of organised networks with specific knowledge of how iPhones work, what they are worth and how to neutralise your ability to track or lock them.

The first thing a professional phone thief will do is put your phone into Airplane Mode or power it off entirely. This cuts ‘Find My’ immediately. If your phone was unlocked when it was taken, they have a narrow window to make changes before they lose signal and they know exactly how to use it.

If your phone was locked, you may have been the victim of shoulder surfing before the snatch. A thief follows you, watches you enter your passcode, then makes the grab. With your passcode, a determined thief can access your Apple ID, disable Find My, change your account password and lock you out permanently before you have reached the next street corner.

Understanding this changes everything about how you approach the steps below. The goal is not just to lock your phone. The goal is to make it so that even with your passcode, a thief cannot access anything that matters.

Before It Happens

These settings take less than twenty minutes to configure. Most people will never do them until it is too late. Do them now, before you finish reading this.

Know your Apple ID password off by heart. Every reactive step after a theft requires logging into iCloud from another device. If you do not know it, write it down somewhere that is not your phone.

Have a secondary device available. An old iPhone in a drawer, an iPad, a laptop — anything that can access icloud.com. When your phone is gone you need to act immediately from something else.

Rename your device to something obvious. Go to Settings, General, About and give it a name you will instantly recognise. When a phone is stolen you may have to search through a list of old devices in Find My under pressure.

Turn on Stolen Device Protection and set it to Always. Go to Settings, Face ID and Passcode, Stolen Device Protection and turn it on. Then change the Require Security Delay setting to Always. This is the single most important setting on this list. Even if a thief knows your passcode they cannot change your Apple ID password, disable Find My or access your saved passwords without Face ID and a mandatory one hour delay. There is no passcode fallback. Available on iOS 17.3 and above.

Disable Control Centre access from the lock screen. Go to Settings, Face ID and Passcode, scroll down to Allow Access When Locked and toggle off Control Centre. This prevents anyone from accessing Airplane Mode or any other Control Centre setting without first unlocking the phone with Face ID. This works on all current iOS versions.

Set Auto-Lock to 30 seconds. Go to Settings, Display and Brightness, Auto-Lock. If your phone is unlocked when it is snatched this limits the window the thief has before it locks itself.

Enable Erase Data Mode. Go to Settings, Face ID and Passcode, Erase Data and turn it on. After ten consecutive failed passcode attempts the phone wipes itself. A wiped phone that cannot be set up without your Apple ID credentials is worth very little to anyone.

Turn on Require Attention for Face ID. Go to Settings, Face ID and Passcode and enable Require Attention for Face ID. Face ID will only unlock when your eyes are open and looking at the screen.

Lock apps with Face ID. On iOS 18, press and hold any app on your home screen and select Require Face ID. Do this for banking apps, photos, notes, email and messaging. Even if a thief knows your passcode they cannot open these apps. Note that you can lock all apps, but you can only fully hide third-party apps from your home screen — native Apple apps like Photos and Notes can be locked but will remain visible.

Change verification methods to email. For every app where possible change two-factor authentication codes to be sent to an email address rather than your phone number. When your SIM is in someone else’s hands any codes sent to your number go straight to them.

Lock WhatsApp. Open WhatsApp, go to Settings, Privacy, App Lock and enable Face ID. Lock individual sensitive chats by long pressing and selecting Lock. On iOS 18 you can also hide locked chats entirely, accessed by typing a code in the WhatsApp search bar. Also go to Settings, Privacy, Advanced and turn on Protect IP Address in Calls and disable link previews.

Move sensitive photos to the Hidden Album. On iOS 18 the hidden album requires Face ID to open regardless of whether the rest of Photos is accessible.

Enable Advanced Data Protection for iCloud. Go to Settings, your Apple ID, iCloud, Advanced Data Protection and turn it on. This applies end-to-end encryption to your iCloud backups, photos and notes. Even if someone accesses your iCloud account from another device the data is encrypted and unusable without your device credentials.

If It Happens - Act Fast

Speed matters here. Every step below should happen within the first hour if possible.

01 - Get to a secondary device and open iCloud. Go to icloud.com/findmy on any browser. Log in with your Apple ID. Go to Devices and locate your stolen phone.

02 - Enable Lost Mode. Click the stolen device and select Enable Lost Mode. This locks the phone and disables Apple Pay. If it shows as Pending the phone is offline and Lost Mode will activate the moment it reconnects. Do not add a callback number to the message. This can be used to scam you.

03 - Do not remove the device from iCloud. This is the most common mistake people make. Removing the device means you lose all ability to track it and it will affect your insurance claim.

04 - Call your network provider. Report the theft and ask them to cancel your SIM immediately. This stops the thief running up a bill and prevents them receiving verification codes sent to your number.

05 - Inform your bank. Call your bank, report the theft and ask them to flag any unusual activity.

06 - Call the police on 101 (UK only — international readers should contact their local non-emergency police line). Report the theft and give them any location data from Find My if the device is still pinging. Ask for a Crime Reference number. You will need this for your insurance claim.

07 - Erase the device. Once you have your Crime Reference number and have accepted that the phone is unlikely to be recovered go back to iCloud and select Erase iPhone. If it shows Pending the erase will complete the next time the device connects to the internet.

08 - Contact your insurance. Start the claims process with your Crime Reference number, your IMEI number and any screenshots of Find My tracking you may have saved.

The Scam Window

In the hours after a phone theft, while your emotions are running high, you are also a target. If you receive a call from someone claiming to have found your phone, a text with a link to track your device, or a call claiming to be from your bank, think before you do anything. These are well-documented scams that follow phone theft specifically. Your bank will not call you out of the blue. Apple will not text you a tracking link. Hang up and call the organisation directly on a number you find yourself.

What Changed in iOS 18

If you had read this guide in late 2024 it would have looked different. Three improvements are worth highlighting.

Stolen Device Protection is stronger. When set to Always there is no scenario in which a thief with your passcode can bypass Face ID to access sensitive settings, passwords or account details. The one hour security delay applies everywhere, not just when the phone is away from familiar locations.

Parts Activation Lock is new in iOS 18 for iPhone 12 and later. Apple has linked the components of iPhones including the display, battery and cameras to the original owner’s Apple Account by their individual serial numbers. When a repair shop installs a part from a stolen iPhone the device flags it and the part cannot be calibrated without the original owner’s credentials. This reduces the black market value of stolen phone components and the financial incentive to steal in the first place.

App locking and hiding is new in iOS 18. In previous versions there was no system-level way to lock individual apps behind Face ID. In iOS 18 you can lock any app so it requires Face ID to open, and third-party apps can be hidden entirely from your home screen and app library.

One More Thing

Not every stolen phone makes it to Shenzhen.

If a thief grabs a phone and realises quickly that they cannot get past the lock screen, or that Lost Mode has already kicked in, they will often throw it. Phones also get dropped in the snatch itself, particularly when the grab does not go cleanly. Either way the result tends to be the same. A phone that survived the theft does not always survive landing on the pavement at speed.

In my experience a cracked or smashed screen is frequently what finishes a phone off after a theft, not the theft itself. This is part of why I built the BWS shop.

The Bodyguard Case is a hardened case designed to take real impact. It will not stop someone grabbing your phone but it gives the device a much better chance of being in one piece if it is dropped, thrown or recovered.

The Field Strap keeps your phone tethered to your body. A grab on a moving bike depends on a clean, unobstructed pull. A strap changes that equation and buys you a moment to react.

Both are available in the collection at blackwidowsecurity.co.uk

This guide is based on personal experience and independent research. Settings may vary by device and iOS version.

Always verify steps with Apple Support if you are unsure.

Safety and Security. From someone hired to protect.

I spent time working undercover on a number of sensitive projects. My job was to blend in, build trust and gather intelligence without anyone knowing who I was or why I was there.

There was no room for error, if someone decided they did not trust me the consequences were immediate. So I learned very quickly that the most important skill I had was not physical, not tactical and not technical. It was the ability to read the people around me in real time and respond to what I found.

I had to match the energy of the people around me before I said a single word. I had to mirror posture, pace and language without making it obvious. I had to notice when someone’s mood shifted, when trust was building or eroding, when a conversation was about to change direction. I had to do all of this while appearing to be entirely relaxed and present.

That is what reading the room looks like at an operational level. What I want to share in this piece is why the underlying skill works, what the science says about it, and how anyone can begin to develop it regardless of their background or profession.

Subscribe now

What the research says:

Reading the room is not intuition in the mystical sense. It is pattern recognition built on observable, measurable signals - and there is a substantial body of research that explains exactly why it works.

The science behind it:

Micro Expressions:

Micro expressions are worth spending a moment on because they are the most specific and actionable element of reading the room and the one that most people have never heard of.

To be clear - they are involuntary. A person cannot choose to suppress them the way they might choose not to say something. They flash across the face in a fraction of a second, too fast to be caught by someone who is not looking for them, but entirely visible to someone who is.

In my undercover work, micro expressions were often the first signal that something had shifted. A flicker of contempt when I said something that did not quite fit. A moment of surprise that told me they knew more than they were letting on.

The face does not lie as quickly as the mouth does. There is always a gap between the genuine reaction and the managed one, that gap is where the information lives.

Ekman categorised the seven universal micro expressions as follows:

01 Happiness is characterised by raised cheeks and crow’s feet around the eyes - a genuine smile involves the eyes in a way that a performed one does not.

02 Contempt appears as a unilateral lip raise, almost always on one side only, and is one of the most significant signals in any negotiation or trust-building context.

03 Fear involves raised and pulled-together brows, raised upper eyelids and stretched lips.

04 Anger shows as lowered brows pulled together, tense lower lids and pressed or open lips.

05 Disgust involves the nose wrinkle and upper lip raise.

06 Sadness produces inner brow raises and downturned lip corners.

07 Surprise, often confused with fear, produces raised brows in a curved rather than straight line.

You do not need to memorise all of these to benefit from this knowledge. The single most useful thing is simply to slow down and look at the face rather than listening only to the words. The face will almost always give you more accurate information.

Mirroring and Rapport:

When I was working undercover, mirroring was not a technique I used consciously at first. It was something I noticed happening naturally when I was genuinely engaged with someone, and something I learned to use deliberately once I understood what it was doing.

Mirroring is the unconscious copying of another person’s body language, speech patterns, pace and energy. Research by psychologist Tanya Chartrand at Duke University found that people who are mirrored by others report higher levels of liking, trust and rapport with that person without being able to identify why. The effect is subconscious and powerful.

In an undercover environment, where trust was the only currency that mattered, mirroring was one of the most effective tools I had. Not exaggerated or obvious copying (that has the opposite effect) but a gradual, natural synchronisation of posture, pace and energy that signals to the other person’s limbic brain that you are safe, aligned and on the same side.

The same principle applies in every negotiation, sales conversation, difficult meeting or first impression. People trust people who feel like them. Mirroring, done well and done genuinely, accelerates that feeling.

The signals worth knowing:

Beyond micro expressions and mirroring, there are four categories of signal that consistently provide reliable information about what is actually happening in any room.

Four things you can do today:

None of this requires specialist training to begin using. These four adjustments will immediately improve how you read and how you are read in any situation.

This is not a security skill or a leadership skill. It is a human skill and anyone can develop it.

Safety and Security. From someone hired to protect.

Share Black Widow Security

What would you do if you saw something that didn't feel right? Not a weapon, not an obvious threat, just something. A person, a behaviour, a detail that made the back of your neck prickle and left you with a feeling you couldn't quite name before your brain had caught up with why.

Would you say something, or would you talk yourself out of it, worry about being wrong, about causing a scene, about wasting someone’s time? Most of us glance across, decide it’s probably nothing, and look back at our phones.

Most people did exactly that on 22 May 2017 at the Ariana Grande concert in Manchester Arena. One person didn’t. They noticed Salman Abedi, they were concerned about what they saw, and they told a security steward. That night, 22 people died.

I work in security and I have spent a significant part of my career thinking about exactly this kind of gap, the space between something being preventable and something becoming irreversible. What the Manchester Arena Inquiry revealed is that the warnings were there, the behaviours were visible, and the systems that should have caught them fell short in ways that were entirely avoidable.

People who act on gut-based instincts are significantly more certain of what they have seen and considerably more willing to speak up about it.1

There is real science behind that feeling, and it is worth understanding. Research co-authored by academics at Yale University and published by the American Psychological Association found that gut-based decisions feel like a more accurate reflection of what we genuinely know. Understanding that is the first step toward doing something useful with them.2

Salman Abedi didn't arrive on the night of 22 May and improvise. He had been planning for months, and in the days immediately before the attack he did something that anyone trained in security would recognise: he carried out hostile reconnaissance.3

Hostile reconnaissance is exactly what it sounds like. Before an attack, a perpetrator visits the target and studies it carefully, looking for entrance and exit routes, identifying where security is strongest and where it falls short, locating cameras and finding the blind spots, working out where to be, when to be there, and what they can get away with. It is methodical and patient, and to the untrained eye it looks like someone simply hanging around.

Abedi made three confirmed visits to the Arena in the days before the attack, the first on 18 May during a Take That concert, four days before the bombing, then again on 21 May, and on the afternoon of 22 May itself he entered the City Room briefly, spoke to two security stewards, and left.4 He came back that evening at 8:30pm carrying his rucksack, which CCTV later showed him bent under, at one point fiddling with wires visible at his clothing. He made his way to the mezzanine level of the Arena foyer - a spot he had already identified during his earlier visits as a CCTV blind spot, and waited there for 58 minutes, having already established in advance that nobody would patrol those stairs.56 At 22:31, he detonated his device.

I spent a period of my career heading up a large behavioural detection team in London, and the distinction my team worked to is one I want to be clear about, because it matters enormously. We were not profiling people.

Profiling is looking at what someone looks like. Behavioural detection is looking at what someone is doing, how they are moving, and whether their behaviour fits the environment they are in.

Every environment has a baseline. A busy train station at rush hour looks, sounds and feels a particular way, a concert venue has its own rhythm, and most people, consciously or not, fit that rhythm. They move with purpose or they browse without it, they look at things worth looking at, and their body language matches what they are doing. When someone deviates from that pattern it registers, and often it registers before you have found the words for why.

On one occasion my team reported a concern about an individual whose behaviour had taken them well outside that baseline. It was a hot day and they were wearing multiple layers with their hood up, they had lapped a couple of buildings in a way that had no natural purpose. This individual then placed their rucksack on the floor and was walking away from it, returning every thirty seconds or so to check it before moving away again. None of those things in isolation is necessarily suspicious, but together, in that context, on that day, they formed a pattern. We reported it and the individual was met by police, which is the system working exactly as it should - a trained eye, a decision to act on what was seen, and a report taken seriously, with nobody talking themselves out of it.

Subscribe now

The Manchester Arena Inquiry produced three volumes of findings, and the conclusions make for difficult reading, not because of their legal complexity but because of their simplicity. Two police officers who should have been on duty were on a two-hour dinner break five miles away, the mezzanine area where Abedi waited for nearly an hour was nobody’s responsibility to patrol because the venue operator and the security contractor had different understandings of whose job it was, and the CCTV operators had not detected his reconnaissance visits in the preceding days despite him walking up and down in front of the entrance doors, yards from security personnel.78 The Arena’s risk assessment was fundamentally flawed, designed in a way that could only produce a low-risk outcome for a terrorist attack, even though on 22 May 2017 the national threat level was SEVERE and an attack was considered highly likely.9

And then there is the detail that stays with me most. A member of the public noticed Abedi and was concerned about his bag, which was large and visibly heavy, and they told a security steward. The Inquiry chairman Sir John Saunders described this as the single most significant missed opportunity of the entire night, the one intervention most likely to have made a difference.10

The behaviours were there, the concern was raised, and the system around it failed to respond.

I want to be careful about how I frame what follows, because the Manchester Arena attack is not a case study in a textbook. Twenty-two people died and hundreds more were injured, many with life-changing consequences. Martyn Hett was 29, and the law carries his name because his mother, Figen Murray, refused to let his death mean nothing, and she has spent years turning the most unimaginable grief into something that might protect others from the same fate. This article exists, in part, because of her.

The reason Manchester matters beyond Manchester is that the pattern is not unique. The hostile reconnaissance, the visible warning signs, the failure to communicate, the failure to act on a concern raised by a member of the public - that gap exists, to varying degrees, in almost every public space, and it will keep existing until the people responsible for those spaces are required to close it. That is what Martyn’s Law is attempting to do.

MARTYN’S LAW — THE TERRORISM (PROTECTION OF PREMISES) ACT 2025

Martyn's Law is aimed at venues and operators, but the lesson of Manchester is not only institutional, it is human. You do not need to be a trained behavioural detection officer to trust what you already notice. You know what normal looks like in the places you spend your time, and when something deviates from that you feel it before you can explain it. That feeling is worth acting on.

Counter Terrorism Policing runs ACT, which stands for Action Counters Terrorism, and the message is a simple one: if something does not feel right, report it. Reports are reviewed around the clock by specialist teams and you will not be wasting anyone's time by raising a concern in good faith.11 For venues and their staff, SCaN (See, Check and Notify) is a free e-learning tool from Counter Terrorism Policing specifically designed to build awareness of hostile reconnaissance and how to respond to it, taking 45 minutes, costing nothing, and with genuinely no reason not to do it.12

I started this piece with a question. What would you do if you saw something that didn't feel right? I think, if you've read this far, you already know the answer. The harder question is whether you'll act on it.

Safety and Security. From someone hired to protect.

Share Black Widow Security

I should say from the outset that I am a huge art fan. The Impressionists in particular. So when I tell you that a Renoir, a Cézanne and a Matisse were stolen from a private museum in Italy last month, I mean it when I say it hurt a little, and don't get me started on the jewels at the Louvre.

On the night of 22 March 2026, four hooded thieves broke into the Magnani-Rocca Foundation, a beautiful villa set in the countryside outside Parma. They forced their way through the front door. An alarm went off. They ignored it, pulled three paintings from the walls, and walked out. Worth around €9 million between them. Gone. In three minutes.1

This came five months after the Louvre heist, where a group of thieves dressed as construction workers entered the Galerie d'Apollon during normal opening hours, used a mechanical ladder mounted on a truck to reach the display cases, and left with eight pieces of the French Crown Jewels. Value: approximately €88 million. Time taken: eight minutes.2

Two of the most audacious thefts in recent European history (ok ok I’m not including the KitKat heist in that statement). Both over before most people have finished their morning coffee. Both in buildings that had security in place.

The alarm at Magnani-Rocca was going off. You can hear it in the surveillance footage, sounding in the background as the thieves carry the paintings calmly across the gardens.3

That detail is worth sitting with. The alarm didn’t fail technically, it worked exactly as it was supposed to. What failed was the assumption that an alarm would be enough to stop someone who had already decided to come in anyway.

Now. I want to be very clear that I did not steal the paintings. I have a moral compass, it works perfectly, and I am not writing this from a cell in Parma (I promise). But I’d be lying if I said I hadn’t read about both heists with a certain professional curiosity.

Sometimes I'm hired to do something not entirely dissimilar. Legally, and with the full knowledge of the client, but with the same objective. Find the way in. Get further than you should. Report back.

It’s called physical penetration testing, and I’ve carried out a lot of them. I’m booked in for plenty more.

The method couldn’t be more different from what happened in Parma or Paris. I don’t always force doors. Alarms don’t always go off. There’s no crowbar involved and certainly no running across Italian gardens with a Renoir under my arm, as tempting as that sounds. What I use is conversation, behaviour, and a significant amount of preparation beforehand. Because the preparation is where this kind of work is actually won or lost.

Before I go anywhere near a building, there's a process. I won't go into the specifics, trade secrets and all that, but the short version is this: by the time I walk through the front door, I already know a great deal about what I'm walking into. The execution on the day mostly looks effortless, because the groundwork that makes it possible happens long before anyone sees me.

What the museum thieves and I have in common isn't the method. It's that neither of us turned up and winged it.

Last week I was asked to test two buildings in central London. The brief was the same as always, attempt to gain unauthorised access, identify the vulnerabilities, report back.

The client was quietly confident about the first one. Good access control, trained staff, a proper setup. They were almost apologetic about it, like they didn’t want to waste my time.

I talked my way past reception and security, they even gave me a lanyard and badge, so I could swipe myself into restricted areas floors, offices, spaces that required credentials I didn’t have. No alarms. No confrontation. Just a conversation that went the way I needed it to.

The second building was easier. I walked straight in. Yikes.

I want to be careful here, because these were real clients and real buildings, and the point isn’t to embarrass anyone. The people working in those buildings were doing their jobs. They weren’t negligent. They were, quite reasonably, inclined to trust someone who presented themselves with confidence and seemed to belong there. That inclination and that very human instinct, is exactly what a physical penetration test is designed to find and address.

After the Louvre was hit, experts were quick to call it a wake-up call, particularly for smaller institutions with valuable collections and older security infrastructure. Christopher Marinello, CEO of Art Recovery International, put it plainly:

“The Louvre theft was supposed to be a wake-up call to museums everywhere, especially small museums.”4

Magnani-Rocca happened five months later.

I see this pattern constantly, at every scale. Security gets put in place in response to the last threat, not the next one. The system was designed for a world that’s moved on, so the gap between what the security is supposed to do and what it would actually do under pressure quietly widens.

The uncomfortable truth is that most security looks fine until someone who’s done their homework walks up to it with a plan.

Three questions worth sitting with - whether you’re running a building, a business, or just thinking about your own home:

1. When was the last time someone actually tested your security — not checked it, but genuinely attempted to get through it?

2. Is your security designed for the threat that came before, or the one that might come next?

3. If someone walked in looking like they belonged, would anyone stop them?

The Magnani-Rocca Foundation is still open. At the time of publishing this, the thieves haven’t been caught. The paintings are gone. A Renoir is missing from a wall it had hung on for decades. That bothers me more than I’d like to admit.

Subscribe now

Safety and Security. From someone hired to protect.

Share Black Widow Security

My friend was mugged a while back.

Four young men surrounded him. Central London. Late at night, walking home from work.

His phone, wallet, cards and cash – all of it gone. Once he got home safely, he called me from his iPad to talk it through.

He was shaken, and gutted – not about the cash, but about the 30th birthday wallet that went with it. He did the right thing handing it over. When you’re faced with four people and the lets face it, very real likelihood that at least one of them is carrying a knife.

There were nearly 15,000 knife crime offences recorded in London in the last twelve months alone

Your belongings are not worth your life. Give them up.

The city is getting more dangerous and it happens more than you’d think. The sad reality is that most people have no idea what to do before, during or after it happens. So here’s what I told him:

Before – your senses are your first line of defence

Your senses are working constantly, even when you’re not consciously paying attention. They notice the change in atmosphere, the shift in energy on a street, the pressure drop that tells you something isn’t right. The problem is that most people spend their time in public actively switching those senses off.

Your phone is the biggest culprit. Walking through a city staring at a bright screen makes your peripherals completely blind. You will not see the four hooded figures loitering. You will not notice the person on a bike slowing down beside you. If you need to check your phone, go inside a building first. The same goes for headphones – if you can’t take them out entirely, one earbud only and keep the volume low enough that you can still hear what’s happening around you. Never both in on a quiet or unfamiliar street at night.

Walk on the building side of the pavement, not the kerb edge. It’s a small change that makes you a significantly harder target – particularly with the rise of moped and bike snatchers.

Stick to well-lit, busy streets where possible. And if you notice the same face three times – cross the road, step into a shop, trust that feeling.

During – comply and observe

If it happens, give up your belongings. I cannot stress this enough. Your wallet, your phone, your watch – none of it is worth the alternative. Comply, stay calm, and take a breath.

While you’re doing so, observe. Age, build, clothing, distinguishing features, height, the direction they leave in. You won’t have long but your memory in that moment is your most valuable tool.

After – don’t just walk away

Once the threat has gone, look up. Which buildings around you have CCTV cameras? Go and speak to the security guard or staff inside. They may have footage, and they deal with this more than you’d think. Ask for a glass of water. Sit down. Give yourself a moment to process what just happened before you do anything else.

Then report it to the police immediately – call 999 if the threat is ongoing, 101 to report afterwards. Get a crime number. You will need it.

Now, his phone and wallet are gone. This is where most people realise they are completely stuck – because every number they know is in a device that no longer belongs to them.

Memorise two numbers before you ever need them. A family member’s number and 999. That’s it. Two numbers.

Your family member can’t transfer money to an app you can no longer access – but they can call you an Uber, come and get you, and make sure you’re not standing alone on a street in shock.

One more thing – keep a small amount of emergency cash somewhere separate from your wallet. A jacket pocket, a cashstash keyring, or yes, your sock. If your wallet goes, you’re not completely stranded.

Next time I’ll be covering what practical steps you need to take in the event of your phone being stolen. See you then x

Subscribe now

Safety and Security. From someone hired to protect.

Share Black Widow Security