— Friday marked the twenty-fifth anniversary of the September 11 attacks, and the argument made in Foreign Affairs to mark it is that core al-Qaeda has ended — not through decapitation but through strategic failure — and that American officials should finally say so.
— An Iran-linked actor used a commercial AI model to compile targeting handbooks on US warships in the Middle East, assembled entirely from photo captions, transponder feeds, commercial satellite imagery and public vulnerability databases.
— The Houthis took the port of Mokha and then Perim Island at the mouth of the Bab el-Mandeb, making the movement the effective power broker of the strait at the moment the Red Sea had become the alternative to Hormuz.
— Nearly four hundred Ukrainian drones over Russian territory in one night, refineries burning in Tatarstan and Krasnodar, Odesa struck for a second consecutive night, and one drone setting fire to a petrol station beside a NATO border crossing.
— The thread: twenty-five years ago the threat had a name, a leadership and a sanctuary. What has replaced it has none of those things — only capabilities, cheap enough and distributed enough that no designation describes them.
I.
Twenty-five years on: a group that has ended, and the sentence Washington will not say
Friday marked the twenty-fifth anniversary of the September 11 attacks, and the case made in Foreign Affairs to mark it is blunt. The organisation Osama bin Laden founded — the one that killed 2,977 people in the World Trade Center, at the Pentagon and in a field in rural Pennsylvania — no longer exists, and American officials should say so plainly instead of burnishing the group's legacy by speaking as though it were still a living enemy. The claim is carefully bounded, and the boundaries matter. Terrorism has not ceased. Jihadism has not gone away. The US–Israeli war on Iran may well generate fresh anti-American violence. What has ended is one specific organisation. The cost of the response that followed is put at more than fifteen thousand American dead in the post-9/11 wars.
The analysis rests on a framework long associated with Audrey Kurth Cronin's work on how terrorist campaigns end. Groups terminate along six pathways, not mutually exclusive: decapitation, negotiation, success, failure, repression, or reorientation into some other mode of operation — ordinary criminality, or insurgency. Core al-Qaeda, on this reading, ended primarily through strategic failure, the outcome bin Laden himself feared, with decapitation and military repression playing real but secondary roles. The May 2011 raid at Abbottabad mattered in two distinct ways. The killing removed the figure around whom the organisation cohered, and the burial at sea denied his followers any shrine or focal point. But the documents recovered that night were arguably worth as much to counter-terrorism as the death itself: they showed a man who had not been centrally directing operations for a considerable time.
There is a sharp secondary argument about definition, and it is the part European readers should sit with. The Authorization for the Use of Military Force that Congress passed on 14 September 2001 did not name al-Qaeda at all. It identified the enemy as whichever nations, organisations or persons the president determined had planned, authorised, committed or aided the attacks. A threat defined that loosely cannot be satisfied, and a campaign with no stated end state cannot be declared finished — which is one reason the same authorisation is still being cited a quarter of a century later. The adjacent question for our own services is whether the surviving al-Qaeda in the — designations still describe command relationships, or have become inherited branding attached to groups with local aims and no operational link to anything that ended.
The English repays close reading because the verbs are graded and not interchangeable. To disrupt is to interrupt an operation. To degrade is to reduce capability while the thing still exists. To dismantle is to take the structure apart. To defeat is to remove the will or the means to continue. To destroy is physical. Officials reach for the weaker verbs when the stronger ones cannot be defended, and the choice is a claim rather than a matter of style. Hold on too to the taxonomy the article depends on: core al-Qaeda (the original organisation), an affiliate (a group that has sworn allegiance), an inspired attacker (no organisational link at all). French « mouvance » absorbs all three, and a great deal of analytical precision disappears into it. Note finally that to end used intransitively — the group ended — has no comfortable French equivalent: the register is « a cessé d'exister », never « s'est terminé ».
A targeting handbook assembled entirely from things anyone can see
On 10 September the American AI company Anthropic published a 154-page threat intelligence report covering misuse of its Claude models that it says it detected and disrupted between December 2025 and August 2026. The Wall Street Journal led on one case in it. An Iran-linked actor, according to the report, used the model — together with a Python pipeline the model helped build — to compile targeting handbooks for identifying and tracking United States naval positions in the Middle East from open-source information. The compiled material is described as including a roster of American personnel scraped from captions on public military photographs, ship and aircraft transponder identifiers, scripts for querying commercial satellite imagery, and an inventory of public websites exposing US naval movements. The actor also researched known vulnerabilities in shipboard communications equipment, among them flaws affecting Cobham Sailor VSAT terminals, Cisco equipment and Schneider Electric EcoStruxure systems. The account was banned, further detections were built, and the findings were passed to government authorities.
The naval case sits inside a far wider catalogue. The same report describes a second Iran-linked actor building an automated identity-profiling tool against hundreds of Israeli government and non-government individuals and modifying open-source credential-theft malware, and a third developing domestic surveillance software for use inside Iran — including the analysis of 155,216 tweets to profile some 6,388 opposition figures in a single year, and a deployed browser extension for mass identity harvesting across social platforms. Sixteen accounts tied to Iranian paramilitary and domestic security bodies were banned. Elsewhere the report covers Chinese surveillance of journalists and religious groups, a Russian state-linked group automating attacks on Ukrainian government targets and drone manufacturers, a group in northern Yemen working on missile guidance, and five cases assessed as potentially supporting biological weapons work — with institutions and countries withheld on the stated grounds that the individuals are working scientists who could be exposed to harm.
The analytical point is that none of the naval work required classified access. Photo captions, AIS and ADS-B transponder feeds, commercial imagery, public vulnerability databases: all of it is lawfully visible to anyone. What the model supplied was not secrets but throughput — the collation, translation and structuring that used to occupy an analytical cell for weeks. This is the oldest problem in open-source intelligence restated at a new speed: the sensitivity was never in the sources, it was always in the aggregation. For force protection and OPSEC the corollary is uncomfortable and concrete. A caption naming a sailor, a unit and a hull number is a data point. Ten thousand of them, sorted and cross-referenced, are a roster — and the service published every one.
One verb is doing precise work here and it is not the French « compiler ». In intelligence English, to compile means to gather scattered elements and structure them into a usable product: the handbook existed in no source, it was made out of them. Guard against the false friend that comes with it — open source in software means freely licensed code, but open-source information means lawfully and publicly available material. Sources ouvertes, not logiciel libre. Two further distinctions repay attention. An actor in this register is an entity conducting activity, never a person on a stage; and the hedging prefix is deliberate — Iran-linked and Iran-nexus are attribution claims consciously weaker than Iranian state, which the report does not write. Note too that to disrupt, in a threat report, means to interrupt or frustrate an operation, and has nothing to do with « disrupter » un marché.
Key terms — et leur équivalent français
threat actor
acteur malveillant, acteur de la menace
Iran-linked, Iran-nexus
lié à l'Iran — attribution volontairement prudente
to compile (a handbook)
constituer : rassembler et structurer des éléments épars
The Houthis have made their largest territorial gain in years. After days of heavy fighting along the Red Sea coast, the movement routed Saudi-backed government forces and took the port of Mokha; the following day the Yemeni government reported the seizure of Perim Island at the mouth of the Bab el-Mandeb, the waterway connecting the Red Sea to the Indian Ocean. The offensive had opened earlier in the week with drone and ballistic missile strikes on Saudi Arabia that set fire to oil facilities in the south of the kingdom and injured more than seventy people. Mokha lies within roughly fifty miles of the strait. Saudi aircraft struck its airport the day after the port fell. Iran's foreign ministry, in its first statement since the city changed hands, called for an end to the Saudi blockade of Yemen and for a return to negotiations.
The Foreign Affairs analysis reads the gain as Tehran's as much as the movement's. Control of both Mokha and Perim makes the Houthis the effective power broker of the strait and makes harassment of shipping considerably easier — and the timing is the substance of the argument, because the Red Sea had become the critical alternative route for Saudi oil once the Strait of Hormuz came under Iranian pressure. Reuters reporting the same week attributed the advance to direct guidance from the Revolutionary Guards, with Iranian and regional sources describing instructions to escalate attacks on Saudi Arabia and promises of further funding, weapons and senior officers; Tehran publicly maintains that the Houthis are an ally and not a proxy. The analysis also stresses what has changed on the supply side: diversified procurement, opaque financing and expanding domestic production mean the arsenal has grown without direct transfers, so interdiction alone no longer caps capability.
Two pressures sit behind the offensive, and both raise the price of any eventual settlement. Militarily, the movement has shattered a truce that had largely held since 2022 and can now demand considerably better terms than the UN-backed road map of 2023, war reparations included; as the advance continues those demands will rise further. Domestically, it faces long-promised public-sector salaries it has not paid and living conditions that have become desperate — more than half of Yemen's population is in acute food insecurity, with six million people at emergency levels bordering on famine. A movement that urgently needs money and a movement that now holds a chokepoint are, unfortunately, the same movement. That is the mechanism by which control of a strait converts into revenue.
Three words here are routinely flattened in translation and should not be. A truce is an informal or temporary suspension of fighting, often local and often unwritten. A ceasefire is a formal agreed halt, usually with terms and sometimes with monitors. An armistice ends the fighting of a war pending a settlement. A report saying a truce has been upended is making a smaller claim than one saying a ceasefire has collapsed, and French usage does not preserve the gap. Then there is proxy, contested precisely because it carries legal weight: to call a group a proxy is to assert direction by a state, which is why Tehran rejects the word while accepting ally. Note finally that chokepoint is a term of art in maritime security rather than a metaphor — « verrou maritime », « point de passage stratégique » — and that the English stress falls on man-DEB.
Key terms — et leur équivalent français
chokepoint
verrou maritime, point de passage stratégique
truce ≠ ceasefire ≠ armistice
trêve ≠ cessez-le-feu ≠ armistice
proxy ≠ ally
supplétif (implique une direction étatique) ≠ allié
Odesa, Nizhnekamsk, Yahodyn: the rear no longer exists
Russia's defence ministry said on Sunday that it had shot down 389 Ukrainian drones overnight, over Tatarstan, other Russian regions and occupied Crimea. Two people were killed and fourteen injured in Nizhnekamsk, a Tatarstan city built around a cluster of oil refineries and industrial plants, when a drone struck a tree beside their parked car; the mayor reported a fire at an unspecified enterprise. Ukraine's military intelligence directorate separately claimed a strike on a major refinery at Slavyansk-on-Kuban in Krasnodar region, saying its drones hit a processing unit and the tank farm and started a blaze visible from tens of kilometres away. In Odesa at least nine people were injured in what the head of the city's military administration called a massive night attack; a strike on a residential high-rise there the previous day killed two and injured twenty-six, destroying the building's upper floors.
The pattern behind the night is an economic one. Moscow has intensified its air campaign in recent weeks, using ballistic missiles and jet-powered drones to penetrate defences precisely as Ukraine's stock of interceptors runs down, with the power grid targeted ahead of winter in what Ukrainian officials describe as an attempt to demoralise civilians. The exchange rate is the substance: a one-way attack drone costs a fraction of the interceptor fired to stop it, and an attacker who can sustain that arithmetic wins simply by continuing. Ukraine's answer is symmetrical and aimed at the same vulnerability — refineries, processing units and tank farms hundreds or thousands of kilometres behind the front line. Neither campaign is battlefield support. Both are strategic attrition of energy infrastructure, conducted with systems cheap enough to send in hundreds.
The item with the longest political reach was the smallest one. A single drone struck near the Yahodyn–Dorohusk crossing on the Polish border and set a petrol station alight; Ukraine's foreign minister described it as Putin's terror knocking directly on the doors of the EU and NATO. Incidents of that kind are then tested, slowly and usually inconclusively, for deliberateness — because navigation error, electronic displacement and deliberate intent all produce the same crater. The consequence that matters is not the eventual finding but the interval before it: the days during which allied capitals have to decide how to speak publicly about an event they cannot yet characterise, knowing that whichever word they choose will be quoted back at them.
Read the Ukrainian Air Force's own formulation closely: drones shot down or suppressed. Those are two different outcomes reported as one figure. Shot down means kinetically destroyed. Suppressed means defeated by electronic warfare — jammed, spoofed, driven off course, lost from tracking — and a suppressed drone still comes down somewhere. A single merged number overstates the defence and hides the debris. Keep also the distinction between a barrage (a mass of munitions delivered together) and a wave (successive pulses designed to exhaust the defender), and between air defence (the system) and an interceptor (the round it fires). One register warning: the wire copy says drones pummelled Odesa. It is vivid press English — « pilonner » — with no place in a note de synthèse, but you must be able to read it without hesitating.
Key terms — et leur équivalent français
shot down ≠ suppressed
abattu (destruction cinétique) ≠ neutralisé par guerre électronique
The 9/11 Commission Report — Final Report of the National Commission on Terrorist Attacks Upon the United States
The anniversary makes the choice obvious, but the reason to read it is technical. Five hundred and eighty-five pages produced by five Republicans and five Democrats, published without a dissenting opinion: the prose had to be acceptable to people who disagreed about everything except the facts. The result is the clearest available demonstration of how English separates narrative from judgement — what happened, who said it happened, and what the Commission concluded, kept visibly apart on the page. Chapter 2, on the rise of bin Laden and the building of the organisation, is the direct counterpart to this week's first item: read the account of how the group was assembled, then read the argument that it has ended.