# Kinematic Threat Brief

**LRRK Watch / Open-Source Intelligence** — Five current signals across systems that sense, move, and act.

| Field | Value |
| --- | --- |
| Collection cutoff | 31 May 2019 |
| Platform | Quiet Systems |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Image rights require separate verification before publication. |

## Executive read

### BLUF

May moved unmanned and covert Act onto Gulf energy infrastructure and named Chinese COTS drones as a civil-sector data threat: drones hit Saudi East–West pipeline pump stations on 14 May, four tankers were damaged off Fujairah on 12 May, and on 20 May DHS/CISA warned U.S. firms that Chinese-made UAS can take American data into an authoritarian state's reach.

### Key judgments

1. **[Assessment — high confidence]** AP reported Saudi Energy Minister Khalid al-Falih saying drones hit the East–West pipeline on 14 May, shutting pumping stations west of Riyadh; Houthis claimed seven drones against "vital Saudi installations" and later the pipeline attack.
2. **[Assessment — high confidence]** BBC, 20 May, reported a U.S. government alert that Chinese-made drones could pose a cyber-espionage risk, quoting the CISA notice's "strong concerns" about technology that takes American data into a state that permits unfettered intelligence-service access.
3. **[Inference — moderate confidence]** The month's trust failure is dual-path: physical Act against energy Move infrastructure, and cloud/app Sense exfil from the same commercial architecture class Interior still flies.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. East–West pipeline — Houthi-claimed drones on Saudi pump stations

*Event / publication dates: 14 May 2019; AP 14 May 2019*

**Verified record — [Fact — B1]** AP, Dubai: an oil pipeline that runs across Saudi Arabia was hit Tuesday by drones, the Saudi energy minister said, days after what the kingdom called an attack on two of its oil tankers near the Persian Gulf. The pipeline from the Eastern Province to a Red Sea port was shut down; al-Falih vowed production and export would not be interrupted. Houthis said they launched seven drones targeting vital Saudi installations, then claimed the pipeline attack via spokesman Brig. Gen. Yahya Saree. Two pumping stations west of the capital supplying the East–West line to Yanbu were the Saudi-described targets. Fetched: https://apnews.com/article/donald-trump-financial-markets-ap-top-news-persian-gulf-tensions-ali-khamenei-63d729241e0645539dad32f57de7bc95

**Threat landscape.** Long-range one-way UAS against pipeline pumping — energy Move, not a runway. Trust boundary is detect/defeat along a desert line-of-pipe, not airport C-UAS.

**Intelligence assessment.** [Assessment — high confidence] Pump stations were hit and Riyadh attributes drones; Houthis claim the Act. [Inference — moderate confidence] The kit is a one-way attack UAV, not a DJI-class quad. [Uncertainty] Launch point, exact type, and whether the claim matches the debris are not in the fetched AP account.

**Opportunity.** A Saudi debris photo with control-surface or engine markings.

**LRRK relevance.** Kestrel / Campaign / Sense-Move-Act. Passport: 14 May, East–West / Yanbu line, two pump stations, Houthi seven-drone claim, al-Falih no-export-interrupt.

**Confidence.** High on the hit and the claim; low on type.

## 02. Fujairah 12 May — four tankers damaged; UAS not the fetched Act layer

*Event / publication dates: 12 May 2019; U.S. later attributes limpet mines / "state actor"*

**Verified record — [Fact — B2]** BBC's 20 June Hormuz timeline (used here for the May event with publication date of the timeline stated) records: 12 May, four oil tankers damaged by explosions off the UAE coast in the Gulf of Oman; UAE says blasts caused by limpet mines planted by a "state actor"; U.S. blames Iran; Iran denies. This filing does not convert Fujairah into a drone attack. Fetched: https://www.bbc.com/news/world-middle-east-48700965

**Threat landscape.** Covert maritime Act on anchored tankers. Trust boundary is harbor/underwater Sense, not UAS C2 — recorded so the later June tanker-plus-drone week is not collapsed into one story.

**Intelligence assessment.** [Assessment — high confidence] Four tankers were damaged 12 May. [Inference — low confidence] UAS involvement is not a fetched May Fact. [Uncertainty] Attribution remains contested in the May–June public record.

**Opportunity.** UAE forensic statement on mine type.

**LRRK relevance.** Watch / Campaign. Negative UAS-as-shooter finding for Fujairah.

**Confidence.** High on the event; high on the negative UAS call for this collection.

## 03. DHS/CISA — Chinese-made UAS as a data-exfil threat

*Event / publication dates: 20 May 2019; BBC 20 May 2019; Reuters 20 May 2019*

**Verified record — [Fact — B1]** BBC: U.S. government alert that Chinese-made drones could pose a cyber-espionage risk to American businesses; notice says "strong concerns" that drone-makers are storing data on China-based servers; users doing national-security or critical-infrastructure tasks most at risk; CISA issued the notice Monday per CNN, which BBC cites. DJI response quoted: government-and-critical-infrastructure customers can get drones that do not transfer data to DJI or via the internet. Fetched: https://www.bbc.co.uk/news/technology-48352271

**Threat landscape.** The commercial Sense node is now a civil-critical-infrastructure warning, not only an Army/DoD ban. Trust boundary is the cloud/app/server path.

**Intelligence assessment.** [Assessment — high confidence] CISA issued a 20 May industry alert on Chinese-manufactured UAS. [Inference — moderate confidence] The alert is brand-class (Chinese-made), not only DJI, though DJI is the market incumbent. [Uncertainty] The full CISA PDF was not fetched as a .gov HTML in this collection; BBC/Reuters quotation is the B1 used.

**Opportunity.** The CISA "Chinese Manufactured Unmanned Aircraft Systems" alert PDF.

**LRRK relevance.** Passport / Control Fabric / Watch. Record: 20 May, CISA, "strong concerns," critical infrastructure, China data-access theory.

**Confidence.** High on the alert; moderate without the PDF.

## 04. Interior still flying the architecture DHS just warned about

*Event / publication dates: Interior 2018 use report 1 April; CISA 20 May*

**Verified record — [Fact — B1]** Interior's 10,342-flight / ~530-aircraft 2018 year is the last fetched civil-federal fleet picture. CISA's warning lands on that fleet's supply base. Fetched: https://www.nextgov.com/emerging-tech/2019/04/interior-doubled-its-use-of-drones-2018/155970/ and BBC CISA URL above.

**Threat landscape.** One U.S. department expands COTS Sense; another warns industry off Chinese COTS Sense.

**Intelligence assessment.** [Assessment — high confidence] The split is now intra-civilian as well as civil/DoD. [Inference — moderate confidence] A Interior grounding is a forward indicator (October/January), not a May Fact. [Uncertainty] May Interior flights on DJI GE not fetched.

**Opportunity.** A May Interior data-management directive.

**LRRK relevance.** Control Fabric / Passport.

**Confidence.** High on the split.

## 05. DoD COTS freeze and extra-theater Reaper — military small-UAS still banned

*Event / publication dates: freeze June 2018; no May 2019 lift fetched*

**Verified record — [Fact — B1]** The Lord/Deasy-POC freeze text remains the military COTS rule. No May blue-UAS list fetched. Fetched: https://www.suasnews.com/2018/06/us-dod-pulls-the-plug-on-cots-drones/

**Threat landscape.** Military small Sense frozen; military HALE ISR in the Gulf is the next month's shoot-down.

**Intelligence assessment.** [Assessment — high confidence] Freeze stands. [Inference — moderate confidence] Gulf tanker crisis will put MQ-9/RQ-4 in the same water-space as the 12–14 May attacks. [Uncertainty] May Reaper orbits not fetched.

**Opportunity.** A CENTCOM May ISR release.

**LRRK relevance.** Campaign / Passport.

**Confidence.** High.

## Forward indicators

Ranked watchlist as of the collection cutoff (what a Watch desk would have monitored next).

1. Next tanker or pipeline hit, and whether debris is UAV, cruise missile, or mine.
2. A U.S. unmanned ISR loss over the Gulf.
3. Interior's answer to the CISA alert (GE buy vs ground).
4. Dated Libya UAV types.
5. Remote ID NPRM.

> **Collection integrity.** Pipeline from the AP page actually fetched. Fujairah from the BBC 20 June timeline with that publication date stated; not converted into a drone attack. CISA alert from the BBC 20 May page actually fetched. Interior and COTS from pages actually fetched. June RQ-4 shoot-down and September Abqaiq were not back-dated.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C1</span></p>