CommandEleven Intelligence // Western Threat Desk. Foresight Audit, status as of November 3, 2026. This audit scores the 2026 Global Counter-Terrorism Assessment (GCTA), published in April 2026, against evidence published afterwards.
Bottom Line Up Front
The GCTA’s chapters on Europe and North America contain four judgments we can score. None is confirmed, one is partly confirmed, one is not confirmed and two remain open. Of the two that can be judged now, the score is 0.5 of 2. The case studies in the chapter are checked separately as baseline facts and do not count.
The largest call was a summer strike wave. We wrote that ISKP and AQIS would carry out “coordinated, multi-city soft target strikes” during the World Cup and the July 4 anniversary. The World Cup ended on July 19 with FBI Director Kash Patel saying there had been no significant criminal attacks, and we found no attack reported on July 4. That call is not confirmed. The pattern we described for Europe held in form: the Berlin Pride ramming on July 25 was a low-sophistication attack by an individual who had pledged allegiance to the Islamic State. Our own record has a problem too. The GCTA’s Palm Springs case study does not match the public record on the date, the perpetrator, the casualties or the ISKP link.
Key Judgments
KJ1: The summer strike wave did not happen. The World Cup closed on July 19 without a significant attack. The disrupted plots we can document were domestic or involved vehicles and drones, and none was tied publicly to ISKP or AQIS. [NOT CONFIRMED]
KJ2: The lone-actor pattern held in form, not in frequency. Europe’s attacks in 2026 used vehicles and knives. Europol counts fewer attacks in 2025 than in 2024. [PARTIALLY CONFIRMED]
KJ3: The cyber-kinetic strike on US data centers and the grid has not come. Iran-linked intrusions into US water and energy control systems are real, but they caused disruption and not physical destruction. The call stays open to year-end. [OPEN]
KJ4: The Hezbollah and Tren de Aragua infiltration claim cannot be tested from open sources. No confirmed case has surfaced, and no source has ruled the route out. [OPEN]
How We Scored
Every call is scored under the Foresight Record rules, set out in full in the GCTA Foresight Audit introduction. The original is quoted and dated, the score rests on evidence published after the GCTA appeared, and confirmed counts 1 and partly confirmed counts 0.5. Where an official attributes something without publishing evidence, we score partly confirmed. A call that depends on a verdict or a data release is held open. Only our own judgments count.
The scored judgments come from the “Summer 2026” threat matrix on pages 64 and 65 and the Europe summary on page 14. The case studies on pages 66 to 69 and the policy comparison on page 70 describe past events and programs, so we checked them as baseline facts. The Hezbollah and Tren de Aragua call also appears in the Latin America chapter, and we score it once, here.
The Scored Calls
| ID | Judgment | GCTA page | Score |
|---|---|---|---|
| NA-01 | ISKP and AQIS carry out coordinated, multi-city soft target strikes during the World Cup and July 4 celebrations | p. 64 | NOT CONFIRMED |
| NA-02 | A cyber-kinetic strike on major US data centers and the Eastern Interconnection grid in 2026 | p. 64 | OPEN |
| NA-03 | Hezbollah and Tren de Aragua move sleeper cells and drone components into the US interior | p. 64 | OPEN |
| NA-04 | High-frequency, low-sophistication lone-actor strikes by individuals radicalized in weeks | pp. 14, 65 | PARTIALLY CONFIRMED |
NA-01. The summer strike wave
What we said (GCTA, p. 64). “Coordinated, multi-city soft target strikes during the 2026 FIFA World Cup and the US 250th Birthday (July 4, 2026) celebrations.” We named ISKP and AQIS as the groups and described drone attacks on open-air fan zones and secondary devices at casualty collection points. We wrote that ISKP media had already distributed target maps of transit hubs in Dallas, Los Angeles and New York.
What the record shows. The World Cup ended on July 19 at MetLife Stadium. In an interview on July 18, FBI Director Kash Patel said there had been no significant criminal attacks during the tournament. Homeland Security Secretary Markwayne Mullin said officials stopped one imminent threat against a Fan Fest, a plot that involved vehicles, and withheld the location. The FAA and Department of Transportation said more than 700 unauthorized drones were seized across the 11 host cities. The most serious disrupted plot was aimed at the UFC Freedom 250 event at the White House on June 14. Five suspects were held and eight people have been charged. Officials said the alleged plan involved explosive-laden drones, a sniper team and an assault on a White House gate, and Anadolu Agency reported that all those detained were US citizens with no sign of foreign involvement. The Islamic State timeline for 2026 has no entry for a World Cup attack or for July 4 in the United States, and we found no report of one.
Score: NOT CONFIRMED. No coordinated multi-city strikes occurred, and no public source ties the disrupted plots to ISKP or AQIS. The result does not show the threat was absent. Heavy security and disrupted plots may explain it, and we cannot separate deterrence from absence.
NA-02. The cyber-kinetic strike on data centers and the grid
What we said (GCTA, p. 64). “A cyber-kinetic Physical Delete strike against major US data centers (AWS/Azure) and the Purdue Level 1 controls of the Eastern Interconnection power grid.” We attributed it to IRGC-linked hacktivists and domestic accelerationists and described vehicle bombs on data center cooling systems timed with a denial-of-service attack to cause a national outage of 48 to 72 hours.
What the record shows. No physical attack on a US data center or on the Eastern Interconnection has been reported. The Iran-linked group CyberAv3ngers has run a campaign against internet-exposed Rockwell controllers that a joint advisory by the FBI, CISA, NSA, EPA, the Department of Energy and US Cyber Command confirmed on April 7 and 8. Victims were in water, energy and municipal systems, and they reported operational disruption and financial loss, but no physical damage has been documented. A wiper attack on the US medical technology company Stryker on March 11 caused outages without physical damage. Iranian drone strikes did damage three Amazon Web Services data centers in the UAE and Bahrain, which is the event the GCTA called a proof of concept, but those sites are outside the United States.
Score: OPEN. The forecast covers 2026 and the year is not over. The cyber intrusions we can document hit different targets and caused no physical destruction. We will close this call at the year-end review on December 31.
NA-03. Hezbollah and Tren de Aragua infiltration
What we said (GCTA, p. 64). “The use of established criminal rat lines to move Sleeper Cells and specialized components (like fiber-optic drone kits) into the US interior.” We named Hezbollah’s Unit 910 and Tren de Aragua and added that operatives use Venezuelan and Colombian identity documents supplied by the gang.
What the record shows. NewsNation reported on March 18 that it had found no confirmed case of Iranian sleeper cells entering the United States. The reporting rests on letters from former Venezuelan officials and unnamed investigators, plus a smuggling payment by one Iranian man to a network linked to the gang. The Department of Homeland Security says the gang is present in at least 46 states. None of this shows a Hezbollah operative using the gang’s routes, and none rules it out.
Score: OPEN. The claim describes covert activity, and the evidence for or against it is not public. We do not score what cannot be checked.
NA-04. The lone-actor pattern
What we said (GCTA, pp. 14, 65). “High-frequency, low-sophistication strikes (stabbings, vehicle rammings, small-arms) by individuals radicalized via the 22-Day Compression.” On page 14 we wrote that the defining threat in Europe is the lone actor driven by rapid, AI-facilitated online radicalization, with perpetrators skewing younger.
What the record shows. Europol’s 2026 report, published July 13, counts 45 terrorist attacks in the EU in 2025: 22 completed, 3 failed and 20 foiled. That is down from 58 in 2024. Jihadist attacks held at 24, with nine completed, and caused five deaths and 81 injuries. Europol names lone actors and online ecosystems, including gaming platforms, as a growing concern. In 2026, a man with a record of spreading Islamic State propaganda stabbed and injured three people at a Swiss train station on May 28, and on July 25 a driver rammed and stabbed people at the Berlin Pride parade, killing one and injuring about 30. He had recorded a pledge of allegiance to the Islamic State. French police arrested six people on July 25 over a plot against a synagogue in Sarcelles.
Score: PARTIALLY CONFIRMED. The weapons and the profile match what we described. The frequency does not: official counts fell in 2025, and we cannot test the claim that radicalization takes 22 days.
Baseline Facts Checked
These are factual statements in the GCTA that were checkable. They are not forecasts and are not counted in the Foresight Record totals. A claim we could not reproduce is marked unverified, which is not the same as wrong.
| GCTA statement | What we found | Status |
|---|---|---|
| Palm Springs clinic bombing, May 14, 2025: perpetrator Caleb Vance, 26, in a Jeep Wrangler; nine others killed, 22 injured; ISKP financial and technical links (pp. 65, 68, 69) | The public record describes a car bombing on May 17, 2025 at a fertility clinic in Palm Springs by Guy Edward Bartkus, 25, in a Ford Fusion. Only the bomber died and four people were injured. The FBI described his views as nihilistic, and no ISIS or ISKP link has been reported. An accomplice, Daniel Park, died in federal custody on June 24, 2025. | Contradicted by the public record |
| New Orleans, January 1, 2025: 14 killed, five allegiance videos posted before the attack (p. 66) | The FBI counted 14 victims killed, 15 with the attacker, and said he posted five videos pledging support for ISIS in the hours before. The FBI also concluded he acted alone. We found no public support for the ISKP handler and the Nangarhar IP link. | Confirmed in part; handler claim unverified |
| ProtectEU launched in early 2026 (p. 70) | The European Commission presented ProtectEU on April 1, 2025. | Incorrect date |
| Minors were 42 percent of terror-related investigations in Europe and North America in 2025 (p. 63) | Europol reports that 130 of the 486 people arrested in the EU in 2025 were 18 or younger, about 27 percent, and 108 of 347 jihadism suspects, about 31 percent. The GCTA figure covers North America too, and we could not reproduce it. | Not reproduced |
| The March 2026 Cloud Blackout in the GCC (p. 64) | Reporting describes Iranian drone strikes on two AWS data centers in the UAE and one in Bahrain, with Gulf services down for days. We found this in one source. | Confirmed in substance, single source |
| ISKP media distributed target maps of transit hubs in Dallas, Los Angeles and New York (p. 64) | We did not find a public report of such maps in the sources we reviewed. | Unverified |
What Would Change These Scores
- Court filings in the UFC Freedom 250 case or any other June or July plot that name ISKP or AQIS direction would move NA-01 to partly confirmed.
- A physical attack on a US data center or a grid control system before December 31 would resolve NA-02 as confirmed or partly confirmed. A quiet year closes it as not confirmed.
- A US indictment that names Hezbollah operatives entering through Tren de Aragua routes would resolve NA-03.
- Europol’s report for 2026 and the FBI’s year-end data would let us score the frequency part of NA-04.
What We Learned
We tied a forecast to the event calendar. The World Cup and July 4 were obvious targets, and the plots we can document in that window were aimed at a political event and at crowds by other means. Next time we will separate what is exposed from what is being planned.
A case study that we cannot match to the public record weakens every forecast that leans on it. The Palm Springs account carries an ISKP link that no public source supports. We are reviewing the GCTA page against the public record and will publish any correction.
What This Audit Does and Doesn’t Establish
- It establishes that no coordinated multi-city attack occurred during the World Cup or around July 4 in the sources we reviewed.
- It establishes that the GCTA’s Palm Springs details and the ProtectEU date do not match the public record.
- It does not show that the threat was absent. Plots were disrupted and security was heavy.
- It does not test the Hezbollah and Tren de Aragua claim, and it does not resolve the data center call before December 31.
- It does not review every attack in Europe or North America in 2026.
Frequently Asked Questions
Was there a terrorist attack at the 2026 World Cup?
Not a significant one, according to FBI Director Kash Patel. Homeland Security Secretary Markwayne Mullin said officials stopped one imminent vehicle threat against a Fan Fest and withheld the location. More than 700 drones were seized.
Was there an attack on July 4, 2026?
We found no report of one. The Islamic State timeline for 2026 has no entry for the date in the United States. Our search was not exhaustive.
Why is the data center call still open?
Because the forecast covers all of 2026 and no physical attack has happened yet. The cyber intrusions that did happen hit water and energy controllers and caused disruption, not destruction.
What was wrong with the Palm Springs case study?
The date, the perpetrator, the casualties and the ISKP link do not match the public record. The bomber, Guy Edward Bartkus, died alone, four people were injured, and no ISIS link has been reported.
Sources
- Eucrim, Europol TE-SAT 2026 (posted September 15, 2026; the report was published July 13, 2026)
- FAA and Department of Transportation, Successful Counter-Drone Efforts Helped Keep Millions of Fans Safe During FIFA World Cup 2026 (July 22, 2026)
- Fox News, Mullin reveals DHS brought down nearly 2,000 drones during World Cup security efforts (July 21, 2026)
- Capitalism Institute, Kash Patel outlines how the FBI secured the 2026 FIFA World Cup (report of an interview on July 18, 2026)
- Anadolu Agency, FBI says alleged plot against Ultimate Fighting Championship event stopped cold (June 2026)
- Wikipedia, Timeline of the Islamic State (2026) (accessed November 3, 2026)
- The Soufan Center, IntelBrief (July 29, 2026)
- NewsNation, Tren de Aragua and Hezbollah links (March 18, 2026)
- RISIdata, Iran-linked CyberAv3ngers multi-sector PLC disruption campaign against US critical infrastructure (2026)
- The Cyber Sec Guru, The Silicon Siege: Every Cyber Attack of the 2026 Iran War Analyzed (2026)
- Wikipedia, 2025 Palm Springs fertility clinic bombing (accessed November 3, 2026)
- Texas Standard, New Orleans rampage suspect acted as lone wolf, FBI says (January 2, 2025)
- European Commission, Commission presents ProtectEU Internal Security Strategy (April 1, 2025)
