Seven items from the past fortnight, all of them assembled from public data. Three of them describe activity that is falling while the pressure behind it rises, which is the harder pattern to write about and the more useful one to track.
Taiwan: the sortie count is down because the pressure moved to the water
First-half fighter detections around Taiwan came in at 1,334, a three-year low and less than half the same period last year. No large-scale drills, and a record number of days with nothing in the air at all. Read alone, that is a de-escalation story, and it has been reported as one.
The maritime series says something else. Taiwan’s coast guard logged 244 mainland vessels in its waters in July, against 58 in July of last year. In the first three weeks of August it counted 152 non-warship hulls, around sixty percent of them coast guard. Since May, the running total near Taiwan and the outlying islands passed 1,200.
That is not a reduction in coercion. It is a change of instrument, from an air activity that Taipei publishes daily and foreign analysts count obsessively, to a law-enforcement presence that accumulates jurisdiction without producing a headline number anyone tracks. Aircraft sorties are expensive, visible, and legible as escalation. Coast guard hulls sitting inside the contiguous zone are cheap, deniable, and build a record of routine administration. The second one is closer to the actual objective.
One caveat applies to every figure here. Taiwan’s ministry publishes what it chooses to publish, and stopped releasing individual flight tracks in early 2024. These are disclosures, not radar.
Hormuz: the declaratory picture and the observable one have separated completely
Washington maintains the strait is open and that dozens of ships move millions of barrels through it daily. Transit data shows traffic falling. Both statements can be defended in public, which is the problem.
What is documented: roughly 75 maritime incidents involving commercial vessels across the Gulf, the strait and the Gulf of Oman since the war began, with around twenty seafarers killed. A new American “tanker for tanker” policy approved at the start of September, under which US forces struck Iranian tankers in retaliation for attacks on shipping rather than to enforce the blockade. CENTCOM footage of a strike on the crude tanker Kylo in the Gulf of Oman on 5 September. Iranian ballistic missile fire toward US warships near the strait. Brent around $100.
The useful indicator here is not the rhetoric on either side. It is the gap between declared status and transit counts, and it has been widening for a month. When a government’s description of a waterway stops matching the traffic through it, the description is doing political work rather than reporting.
Svalbard: the disclosure is the weapon
NATO allies intercepted Russian GUGI submersibles near Svalbard this spring, rehearsing the deployment of a system built to disable subsea cables without leaving attributable damage. Britain and Norway said in April that they had found a covert operation in Arctic waters. The location, the American role and the existence of the new capability came out on 10 September.
Two cables run 1,400 km from Svalbard to the Norwegian mainland, as deep as 2,700 metres, and they carry the downlink traffic from the SvalSat ground station. A replacement route is not planned before 2028.
The part worth noting analytically is the publication decision. London and Oslo took their findings to Moscow directly, on the reasoning that a covert capability loses value once the target names it. That is deterrence by disclosure, and it is now being used on a class of weapon whose entire purpose was ambiguity. Expect more of it, and expect the next Russian counter to be designed against the disclosure rather than the detection.
The silence around the incursions
An IISS count puts drone incursions over European airports and military sites at 144 since August 2024. Romania alone records 33 airspace violations since the invasion, 18 of them this year. In July, NATO moved the engagement authority for Baltic Air Policing from national capitals into the alliance chain, and an Italian Eurofighter took a drone down over Latvia in August, the third such kill since May.
No ally has requested Article 4 consultations since Poland’s mass incursion a year ago. Not after a cruise missile came down well inside Polish territory, not after a bomb-carrying drone closed a NATO airlift hub.
That is the finding. The alliance has quietly delegated the shooting downward while removing the political event upward, so each incident is now handled as air defence routine rather than as a collective security question. It is an efficient way to avoid a crisis. It also means the observable escalation ladder no longer has a rung between “shoot it down” and “invoke the treaty,” and nobody has tested what sits in that gap.
Attribution by sophistication is finished
The 10 September threat report from Anthropic covers operations disrupted between December 2025 and August 2026 across seven categories of harm. The case that matters for analysts is a Russian state-nexus espionage operation that ran 130 days and reached 24 of its 27 targeted institutions, largely by delegating reconnaissance, tooling and exploitation to automated systems with a human choosing targets and reading results.
The structural claim in the report is the one to absorb: capability no longer indicates resources. A lone operator with stolen API keys now produces output that reads like a funded state programme, and the report also documents state security bodies running population-scale monitoring platforms, including one built to process communications across 25 million mobile SIMs.
For OSINT work this breaks a heuristic that most of the field still leans on. Tradecraft quality has been a proxy for actor class since the beginning. That proxy is gone. What remains is infrastructure reuse, targeting logic and timing, which are slower and less satisfying to work with, and which are now the only things carrying weight.
Russia is importing fuel, and only the shipping data shows it
Sustained Ukrainian strikes on Russian refining capacity have produced a result that no announcement will confirm: Russia buying refined product at scale. Shipping and trade-flow analysis puts imports across July and August at roughly 3.85 million barrels, starting near 500,000 in July and climbing from there.
This is the cleanest available measure of what the strike campaign has actually achieved. Damage assessments from imagery tell you what a refinery looks like. Import volumes tell you what it can no longer produce. The second question is the one that matters, and the answer sits in commercial data rather than in anything either government says.
The chip controls and the market that stopped existing
Nvidia’s annual filing states plainly that the company is effectively foreclosed from China’s data centre compute market, and that the foreclosure has helped rivals build larger ecosystems against it worldwide. Enforcement work continues regardless: the affiliates rule, licence requirements keyed to ultimate parent location, and reporting on a blacklisted server maker’s American subsidiary shipping advanced parts through a gap in entity-list logic.
The inversion is worth stating directly. Controls tighten as the market they govern disappears, so each new rule buys less and signals more. Meanwhile the two governments are reportedly preparing a mid-September AI meeting whose agenda includes monitoring AI-directed cyber attacks and having labs in both countries exchange threat intelligence. Cooperation on the misuse side, foreclosure on the hardware side, negotiated at the same table.
Collection note
A 342-metre laden tanker was imaged on 10 September running dark about 45 km off Dubai, trailing a widening oil slick. It was found because of the slick, not the transponder.
Worth keeping in mind alongside a detail from the same source: a spike in dark transits in late July reflected a satellite collection timed to catch them, not a change in vessel behaviour. Detection volume moves when sensors move. Before treating any dark-activity series as a trend, check whether the ships changed or the cameras did.