Intelligence library.

Taking back the device: what owner-side reverse engineering buys, and what it costs

Taking Back Your Own Devices

In October 2026, owners reported using AI coding tools to strip ads and preinstalled apps from smart TVs and to revive devices their makers had abandoned. This brief asks what each kind of change actually delivers, whether a cleaner screen means less data collection or a safer home network, and who maintains a device once it has been changed. Built from press reporting, state enforcement records, an FBI warning and copyright rulemaking. For households and their security leads.

What customers will still pay for: IP value when the function gets cheap

What Customers Will Still Pay For

An August 2026 survey found that about a third of respondents' organizations had passed on buying some software because AI tools let them build it, and a major platform folded a paid AI add-on into its plans. This brief asks what still commands a price once a product's main function becomes easy to get, and how owners and buyers should test it. Built from survey data, company disclosures, field experiments and practitioner accounts. For principals, family offices and their advisors.

The triage worksheet and escalation protocol

A working version of the CB-279 doctrine: an intake record, a worksheet that separates the signal from the actor and the response, an escalation protocol template, household reporting cards, and rules for collection, attribution, correction and retention. It is a prototype, so far tested only by AI assessors. For security leads and family offices that want escalation decided in writing before a case arrives.

When hostility becomes targeting: assess the actor, not just the words

Watch the Conduct, Not Just the Words

Threat caseloads against American officials and their families reached record levels in 2025 and kept rising in 2026, pushing protective teams toward triage by message. This brief asks what that approach misses, drawing on research into people who attacked or approached public figures, and how to assess the actor, the behavior, the access and the context instead. Built from Secret Service research, federal case data and current caseload figures. For security leads running threat intake.

The Supply Chain Has a Home Address

Your Home Is Part of the Supply Chain

On 11 October 2026 officials from five European intelligence services described intensified Russian efforts against defense-industry executives, including surveillance at home and at work. This brief asks what that pattern means for executives, founders and investors tied to work that reaches Ukraine, and how protection can match the evidence without delivering the disruption an adversary wants. Built from government statements, officials' public remarks and press reporting. For family offices, security leads and boards in the sector.

The identifier was the target: how ad systems make a principal selectable

The Ad System Can Pick Out Your Phone

The October 2026 disclosures about spyware delivered through advertising also showed advertising identifiers, synced cookies and IP addresses working as a way to pick out specific devices. Companion to CB-276, this brief asks how a principal becomes selectable through that identity layer, which links in it can be reduced, and whether removal from people-search sites reaches it. Built from the same primary research reports. For security leads and family offices.

Closing the ad channel: a device protocol for principals

A device protocol behind CB-276 for closing the advertising channel on a principal's phones, computers and networks: four layers of settings and filtering, a verification test recorded for each device and channel, a look back through retained logs, and a thirty-day rollout. Each layer's known gap is stated. For the security lead or family office technologist who has to make the controls hold on real devices.

The ad was the access: zero-click spyware by advertisement

Spyware Can Arrive Through an Ad

On 15 October 2026 researchers published the first public technical confirmation of mercenary spyware delivered through targeted advertising, with no click or other action by the person targeted. This brief asks how the machinery that decides which device sees which ad was turned into a delivery system, and where a principal's devices can be protected before an ad ever loads. Built from two primary research reports and contemporaneous reporting. For security leads and family office technologists.

The instant match: one phone number, one confident profile

Your Phone Number Opens a Profile

A class of lookup products now turns a phone number or an address into a named person and a profile in seconds, sold to real estate agents, home health workers and consumers. This brief asks how to separate who a person is from what has been attached to them and what has actually been verified. Built from vendor disclosures, a 2023 federal enforcement action, investigative reporting and case law. For family offices managing misidentification risk.

The identifier became the lead: screening beyond what you filed

Your Contact Details Start the Border Search

A Homeland Security inventory released in January 2026 lists a border agency tool built to find social media accounts, phone numbers and emails the agency did not already hold for a traveler. This brief asks what changes when screening starts from what a traveler filed and expands beyond it, and how a link discovered this way is confirmed or corrected. Built from the inventory entry, vendor material and a privacy assessment obtained under FOIA. For principals who travel.

The debunking trap: when the correction becomes the distribution

Before You Answer a Fake

A pro-Russian operation spent two years asking newsrooms and fact-checkers to verify its fakes, and hundreds of debunks followed. This brief asks what a correction repairs and what it spreads, and when answering a fabrication about a principal serves the attacker's timing more than the principal's interest. Built from four published assessments of the operation, read in time order, and the research on corrections. Companion to CB-272, for principals and communications leads.

The response was the weapon: capturing the argument, counterfeiting the source

Attackers Want Your Reaction

Some influence operations do not try to win an argument; they steer how defenders answer, or borrow the authority a decision depends on. This brief asks how those two attacks differ from ordinary disinformation, using documented campaigns and civilian cases as analogues, and what each demands of the team answering for a principal. Built from a July 2026 Small Wars Journal essay and public research. For principals and their communications staff.