01 / U.S. Government Accountability OfficeSeptember 3, 2026
Secret Service protection policies must keep pace with the threat
What the report examines
GAO-26-108455 reviews protection policy oversight and compares federal protective responsibilities. Its significance extends beyond one event to how an organization learns from incidents.
Reported findings
- GAO identified 83 security incidents in fiscal years 2015–2025; protection policies changed in response to 25.
- Eight of 22 policies were overdue for review or update. Decisions not to revise policy lacked a required documented rationale.
- Four recommendations address review accountability, decision records and an outdated Secret Service–State Department agreement.
Global Makarios assessment
The issue for a protection program is whether experience changes the next mission. A near miss can generate a meeting and a written report without changing a briefing, an assignment or a rehearsed response. Leadership needs to see which lesson became an operational requirement, who implemented it and whether it works under realistic conditions. The incident totals do not mean every event required a policy change.
Operational priorities
- Give every material finding a disposition: change a control, investigate further or document why the existing control remains appropriate.
- Assign an owner and a review date; link the decision to the relevant advance checklist, training requirement or partner agreement.
- Verify closure through an exercise, observation or other evidence, and reopen the issue when conditions change.
Leadership question: Can your team show what changed after its last significant incident—and who verified the change?
Source: GAO-26-108455, Highlights and Recommendations for Executive Action. files.gao.gov/reports/GAO-26-108455/index.html
02 / Bipartisan House Task ForceAdopted December 5; released December 10, 2024
Butler revealed failures across the entire protective operation
What the report examines
The final House investigation covers Butler and the subsequent West Palm Beach incident, with 37 recommendations. It organizes Butler’s failures around planning, execution and leadership.
Reported findings
- Planning findings include the unsecured AGR complex, sightlines, resources, threat-information sharing and counter-drone readiness.
- Execution findings address fragmented communications, separate command posts and missed opportunities to intervene.
- Leadership findings include training gaps and unclear responsibilities.
Global Makarios assessment
For executive protection and major events, a venue plan cannot be treated as a collection of independent assignments. The vulnerability between assignments can be as consequential as a weakness within one post. A complete advance should connect the assessed threat, surrounding environment, protective resources, partner responsibilities and the decision to proceed. A map with colored boundaries is not evidence that every critical responsibility has an owner.
Operational priorities
- Review the operating environment beyond the ticketed or contracted footprint and record which organization owns each relevant concern.
- Reconcile the plans of the detail, venue, local partners and response functions before the principal arrives.
- Require unresolved issues to reach a named decision maker; record the compensating measure or the reason the mission must change.
Leadership question: Where could two participating organizations each believe the other is responsible?
Source: House Task Force, Final Report of Findings and Recommendations, December 2024; Butler security failures and recommendations, report pages 48–113. taskforce.house.gov
03 / Senate HSGAC and Permanent Subcommittee on InvestigationsInterim report September 2024; chairman’s final report July 13, 2025
A warning has value only when it reaches someone able to act
What the report examines
The joint bipartisan inquiry produced an interim report. Chairman Rand Paul’s later final report drew on 17 interviews and more than 75,000 pages of records.
Reported findings
- The chairman’s findings identify denied resources, unclear advance responsibilities and poor coordination with state and local partners.
- Pertinent intelligence did not reach agents responsible for site security.
- Information about the suspicious individual was not communicated to the shift detail that could have kept Trump offstage.
Global Makarios assessment
Protective intelligence must travel all the way to an operational decision. An analyst, command post or liaison receiving information does not establish that the person controlling movement has received and understood it. Executive offices and protective teams need a common understanding of what requires immediate attention, which facts are still uncertain and who may change the plan. That understanding should survive a busy radio channel or a change of shift.
Operational priorities
- Define escalation thresholds around potential consequences to the principal rather than around which team first receives the information.
- Require acknowledgment for critical warnings and a fallback route when the intended recipient cannot be reached.
- Exercise the decision pathway from initial observation through assessment, command notification and operational disposition.
Leadership question: Who can hold or change a movement, and how does an urgent concern reach that person?
Source: Senate HSGAC, chairman’s final-report release and findings, July 13, 2025. hsgac.senate.gov
04 / DHS Independent Review PanelReport dated October 15, 2024; publicly released October 17
Correct the organizational conditions that allow operational failures
What the report examines
The independent panel examined both the immediate breakdowns at Butler and deeper institutional problems. Its remit was to recommend changes that would reduce the risk of recurrence.
Reported findings
- The panel described an organization that had become bureaucratic and insufficiently adaptive to changing threats.
- Its examination covered operational responsibility, communication and the protective mission.
- The panel called for fundamental reform rather than treating individual mistakes as the complete explanation.
Global Makarios assessment
A protective program can have experienced personnel and still allow weak assumptions to become routine. Readiness requires a working environment in which concerns are raised, evaluated and resolved before they become emergencies. Resources matter, but leadership also needs to know whether staff understand the mission, whether assignments fit their preparation and whether previous lessons are reaching the people doing the work.
Operational priorities
- Use readiness reviews to surface unresolved dependencies and conflicting assumptions, with a clear route for escalation.
- Evaluate exercises for decision quality, coordination and follow-through rather than attendance alone.
- Make recurring deficiencies visible to leadership and track whether corrective work changes actual practice.
Leadership question: What mechanism allows a team member to challenge an unsafe assumption before the operation starts?
Source: Independent Review Panel Final Report, October 2024. Government archive: govinfo.gov/app/details/GOVPUB-HS9-PURL-gpo233974
05 / U.S. Secret Service; House Task Force responsePublic review summary and House response November 1, 2024
An internal review must lead to demonstrable operational improvement
What the report examines
The Mission Assurance Inquiry public summary addresses security failures and the agency’s response at Butler. The House task force’s public response provides an additional accountability perspective.
Reported findings
- The House said the agency’s review aligned with its own investigation of July 13 security failures.
- It acknowledged proposed improvements while calling for additional accountability and measures against recurrence.
- The review’s stated focus was the security failure, rather than resolving every question about the shooter.
Global Makarios assessment
The practical question after a review is what a protective team will do differently on its next assignment. A revised policy is only one stage of that work. The people responsible must understand the change, have the resources to carry it out and demonstrate the intended behavior. This distinction is especially important where a fix crosses organizational boundaries or depends on an outside partner.
Operational priorities
- Translate findings into specific tasks with an accountable owner, dependencies and evidence needed for closure.
- Connect approved changes to briefings, operating procedures and exercises that reach the affected personnel.
- Test the corrective action under realistic conditions and retain unresolved risk for leadership review instead of marking it complete administratively.
Leadership question: Is a corrective action considered complete when it is written, or when its effectiveness has been demonstrated?
Source: Mission Assurance Inquiry public summary; House Task Force statement on the Secret Service Mission Assurance Review, November 1, 2024. taskforce-kelly.house.gov
06 / GAO review publicly released by Chairman Chuck GrassleyJuly 12, 2025
Threat knowledge must influence site preparation and resource decisions
What the report examines
The publicly released Butler review examined policy gaps in intelligence sharing and protective planning. Chairman Grassley’s release describes eight GAO recommendations.
Reported findings
- Senior officials received threat intelligence ten days before Butler that did not reach personnel securing the event.
- The release describes a missing process for sharing classified threat information not judged imminent.
- Other findings concern resource allocation, training and communication readiness.
Global Makarios assessment
Different parts of a protective organization can make individually reasonable decisions from an incomplete picture. The people allocating assets may not see the concern driving a request; the people planning an event may not know why additional protection is warranted. A useful risk process must preserve the operational significance of sensitive information while respecting how that information is handled. Availability alone is an incomplete basis for deciding what protection is sufficient.
Operational priorities
- Make resource requests explain the mission requirement and the risk the requested capability is intended to address.
- Record how unavailable resources affect the plan and who accepts the remaining risk or authorizes an alternative.
- Establish a route for communicating actionable protective requirements to the people who need them, including appropriate partner organizations.
Leadership question: Could your site plan and resource allocation be based on materially different threat pictures?
Source: Grassley release, GAO USSS report and eight recommendations, July 12, 2025. grassley.senate.gov
07 / DHS inspector general findings as reported by ReutersReuters coverage July 2, 2026
Separate communications can leave the protection team without the warning
What the report examines
Later inspector general reporting adds a specific measure of the information-sharing breakdown at Butler. This entry attributes the finding to Reuters’ coverage of the government report.
Reported findings
- Reuters reported that the Secret Service did not receive 102 local radio transmissions concerning the gunman.
- Its reporting identified the absence of a joint communications room with local law enforcement as a central problem.
Global Makarios assessment
More radios and more personnel do not by themselves produce a shared operational picture. A warning may exist within one organization while the team responsible for the principal remains unaware. Communications planning should identify who monitors each input, how an urgent report crosses organizational boundaries and how receipt is confirmed. The quality of that transfer matters more than the fact that equipment is present.
Operational priorities
- Test the actual communications arrangement with the organizations assigned to the mission, including degraded or congested conditions.
- Assign responsibility for monitoring, relaying, acknowledging and escalating critical information.
- Rehearse what happens when the primary route fails, and confirm that incoming personnel understand the arrangement at handover.
Leadership question: Can a local partner’s urgent observation reach the protective decision maker without relying on an improvised phone call?
Source: Reuters, Watchdog faults Secret Service for missing 102 radio calls during 2024 Trump shooting, July 2, 2026. Secondary coverage of DHS inspector general findings.
08 / Proofpoint threat research · Weekly intelligence selection 1 of 3October 1, 2026
A credible professional introduction can become an account-compromise pathway
What the report examines
Our October 8 intelligence document includes Proofpoint’s research on TA419 activity targeting AI-policy experts. This is reporting about identity impersonation and credential phishing, not evidence that every approach used synthetic video.
Reported findings
- Proofpoint describes impersonation of real experts and apparently benign outreach to build rapport.
- Follow-up material led targets to a proxied cloud sign-in experience.
- Successful password and MFA checks could still leave the attacker with the authenticated session.
Global Makarios assessment
The protective perimeter includes the executive’s professional relationships and the staff who manage invitations, documents and calendars. A plausible invitation can reach a person who has little reason to expect an attack. Once an account is compromised, the concern extends beyond that account’s inbox to the information and relationships accessible through it. Our weekly assessment emphasizes that confidence in a person’s name must be separated from verification of a particular approach.
Operational priorities
- Independently confirm unexpected professional invitations or sensitive document requests through an established contact route.
- Prioritize phishing-resistant authentication for executive, assistant, legal, finance and protective-operation accounts.
- If compromise is suspected, address active sessions and connected access as well as the password; assess whether principal-related information was exposed.
Leadership question: Does your response stop at a password reset, or does it verify that unauthorized access has ended?
Source: Proofpoint, Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles, October 1, 2026. Selected in Global Makarios weekly reporting through October 2.
09 / Recorded Future analysis · Weekly intelligence selection 2 of 3September 29, 2026
A synthetic face is one component of a larger trust-manufacturing process
What the report examines
Our weekly intelligence document includes Recorded Future’s analysis of social engineering involving synthetic media. The report connects AI-enabled research and persuasive content with fabricated identity and exploitation of personal information.
Reported findings
- The analysis considers target research, lure generation, identity fabrication and sorting of exposed personal information.
- Synthetic audio or video can reinforce other apparently credible identity cues.
- The weekly assessment emphasizes independent verification and additional approval for consequential requests.
Global Makarios assessment
A caller can appear convincing because several details agree: the name, the voice, the company, the meeting context and information about the recipient. Those details are not necessarily independent evidence. A coordinated impersonation can supply them together. For an executive office, the relevant risk is the action that apparent credibility authorizes: disclosing an itinerary, changing a payment, granting access or redirecting movement. The recipient needs a reliable process that does not depend on spotting a visual defect.
Operational priorities
- Define which requests require independent verification before money, information, access or movement is affected.
- Give assistants, household staff and trusted vendors a usable escalation route when a familiar person makes an unusual request.
- Exercise plausible voice and video scenarios, and evaluate whether the established approval process survives urgency and apparent authority.
Leadership question: If every visible identity cue came from the same impersonator, what independent check would remain?
Source: Recorded Future, Social Engineering in the Age of Synthetic Media, September 29, 2026; summarized in Global Makarios Current Intelligence Document, October 8, reporting cutoff October 2.
10 / FBI Newark warning · Weekly intelligence selection 3 of 3September 29, 2026
Confirm who initiated the request—not merely whether the person exists
What the report examines
The FBI warning describes fraudsters posing as federal agents. It is an authority-impersonation case, including a staged virtual-office setting; that setting alone is not proof of AI-generated video.
Reported findings
- Scammers used real agents’ names and spoofed field-office telephone numbers.
- Confirming an agent’s employment could falsely reassure a victim about the fraudulent contact.
- One impersonator staged an online meeting to resemble an FBI office.
Global Makarios assessment
A verification step can fail even when the answer it produces is true. The named employee may exist, the organization may be real and its telephone number may be genuine, while the specific request remains fraudulent. Our weekly report therefore treats contact provenance—the origin of the actual approach—as a separate question. For high-profile principals, the same distinction matters when requests appear to come from counsel, financial institutions, law enforcement or trusted service providers.
Operational priorities
- Obtain the organization’s contact details independently and ask whether it initiated the specific outreach or request.
- Keep sensitive disclosures and financial or access decisions on hold while the origin and authority of the request are resolved.
- Preserve relevant communication details and escalate suspected impersonation through the organization’s established response process.
Leadership question: Does your callback confirm the person’s employment, or that the person actually contacted you?
Source: FBI Newark, FBI Newark Issues Warning About Insidious New Twist on an Old Fraud Scheme, September 29, 2026. Selected in Global Makarios weekly reporting through October 2.
